Cloudanix VulnDB

CVE-2026-98371

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux handles certain encrypted network packets can let an attacker crash the whole system, causing outages until it is restarted.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Buffer overflow during IPTFS inner packet reassembly when short declared tot_len triggers header copy past allocation and subsequent underflow in payload length calculation, resulting in skb_over_panic.

Why it matters to the business

Remote or local denial-of-service crashes on Linux VPN gateways and hosts using IPTFS, disrupting encrypted traffic and requiring reboots with potential loss of availability.

How an attack unfolds

Attacker sends crafted IPTFS outer packets that split an inner IPv4 packet so the first fragment leaves fewer than 4 bytes; the continuation packet declares a small tot_len that passes the weak >=6 check but is smaller than the IP header, causing out-of-bounds write and underflow during reassembly in __input_process_payload and iptfs_reassem_cont.

How to fix it

Upgrade the Linux kernel to a version containing the fix that enforces inner length >= IP header size before runt reassembly allocation; apply the patch that aligns the runt path with normal-path validation.

How to confirm the fix worked

Confirm kernel source contains the updated iptfs_reassem_cont length check requiring tot_len to cover minimum IP header; test reassembly with packets declaring inner lengths 6-19 and verify no panic occurs.

Typical attack path

  1. Establish or abuse an IPTFS security association (local userns/netns or remote VPN gateway)
  2. Send outer packet containing partial inner packet start with tot_len in [6,19]
  3. Follow with continuation packet carrying the remainder
  4. Trigger skb_put exceeding tailroom during header completion and payload copy
  5. Induce kernel panic

How to detect it

Search kernel logs and crash dumps for skb_over_panic or IPTFS reassembly messages; inspect netfilter or xfrm audit logs for unusual IPTFS SA activity around the time of panics.

What your security team should do

  • Prioritize kernel updates on all systems exposing IPTFS SAs or acting as IPTFS gateways
  • Restrict IPTFS usage to trusted peers until patched
  • Monitor for skb_over_panic crashes in kernel logs
  • Disable IPTFS where not required

The record

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner tot_len When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, __input_process_payload() saves those bytes as a runt and skips the iplen/iphlen validation performed for in-place packets. When the continuation packet arrives, iptfs_reassem_cont() only requires the declared inner length to be >= sizeof(ra_runt) (6) before allocating the reassembly skb with that attacker-controlled length. However, __iptfs_iphlen() always returns the fixed minimum IP header size (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in [6, 19] the header-completion copy writes past the declared packet length, and the subsequent "ipremain -= copylen" underflows to ~4GB, leaving the payload copy length bounded only by blkoff (up to 64KB). At runtime the skb_put() tailroom check turns this into skb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable locally via userns+netns IPTFS SAs and remotely against IPTFS VPN gateways when the decrypted outer skb is linear (e.g. AF_PACKET taps, tun/tap delivery). Align the runt path with the normal path by requiring the declared inner length to cover at least the IP header size. This also subsumes the previous >= sizeof(ra_runt) check, since the minimum IP header is always larger than the runt buffer. This issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab.

Affected packages

Ecosystem Package Introduced Fixed