Cloudanix VulnDB

CVE-2026-98402

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel network error reporting bug can produce warnings or instability on debug systems when handling certain network problems.

Exploitation
Other
Attacker needs
None
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The flaw performs unconditional udp_hdr access and skb_transport_header dereference in the icmp_send tracepoint without verifying IPPROTO_UDP or that transport_header was initialized, violating assumptions in paths such as link failures and AF_PACKET.

Why it matters to the business

Debug-enabled kernels may log warnings or panic during routine network error handling, reducing stability on systems that experience frequent route or link issues.

How an attack unfolds

An attacker induces an ICMP-triggering condition (for example link failure in a vti tunnel) from a context where skb transport metadata is unset; the tracepoint then executes the unsafe header access and hits the debug warning.

How to fix it

Apply the upstream fix that gates UDP header parsing on iph->protocol == IPPROTO_UDP and replaces direct transport_header access with skb_header_pointer at network offset plus IHL.

How to confirm the fix worked

Inspect the icmp tracepoint code for the protocol check and skb_header_pointer usage; confirm absence of the original unconditional udp_hdr call and the DEBUG_NET warning site.

Typical attack path

  1. Trigger network condition causing dst_link_failure
  2. Enter vti_tunnel_xmit or similar transmit path
  3. Call __icmp_send without transport_header set
  4. Tracepoint unconditionally invokes udp_hdr and skb_transport_header
  5. DEBUG_NET_WARN_ON_ONCE fires under CONFIG_DEBUG_NET=y

How to detect it

Search kernel logs and dmesg for the exact WARNING strings referencing skb_transport_header, udp_hdr, and trace_event_raw_event_icmp_send; correlate with network error events in vti or route code paths.

  • WARNING: at skb_transport_header include/linux/skbuff.h:3087
  • WARNING: at udp_hdr include/linux/udp.h:23
  • trace_event_raw_event_icmp_send+0x48c
  • do_trace_event_raw_event_icmp_send

What your security team should do

  • Upgrade affected kernels to a version containing the described tracepoint fix
  • Disable CONFIG_DEBUG_NET on production systems until patched
  • Monitor kernel logs for the skb_transport_header warning pattern

The record

In the Linux kernel, the following vulnerability has been resolved: net: icmp: avoid invalid transport header access in icmp_send tracepoint syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE(): WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline] WARNING: at udp_hdr include/linux/udp.h:23 [inline] WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skb_transport_header include/linux/skbuff.h:3087 [inline] udp_hdr include/linux/udp.h:23 [inline] do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 __traceiter_icmp_send include/trace/events/icmp.h:11 [inline] __do_trace_icmp_send include/trace/events/icmp.h:11 [inline] trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11 __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline] ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287 dst_link_failure include/net/dst.h:438 [inline] vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307 TP_fast_assign() unconditionally calls udp_hdr(skb) before checking whether the packet is UDP. Furthermore, __icmp_send() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AF_PACKET) where skb->transport_header was never initialized (~0U). Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)). Fix this by: 1. Only parsing transport info when iph->protocol == IPPROTO_UDP. 2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2) to safely fetch the UDP header without assuming transport_header is set.

Affected packages

Ecosystem Package Introduced Fixed