Cloudanix VulnDB

CVE-2026-98417

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux kernel network security processing can cause certain encrypted network packets to be mishandled, potentially disrupting secure connections until systems are updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Improper handling of transport header offsets in ESP-in-TCP packets after TCP stream parser trimming causes offset truncation in XFRM, triggering skb warning paths instead of graceful error handling.

Why it matters to the business

Potential packet processing instability or drops in IPsec-protected network traffic, leading to degraded VPN connectivity, increased operational monitoring overhead, and risk of service disruption in Linux-based network appliances.

How an attack unfolds

An attacker crafts ESP-in-TCP packets with unrepresentable transport header offsets that survive the TCP envelope trim; upon XFRM processing the offset reset truncates the value and diverts the skb into the warning path rather than a clean drop.

How to fix it

Apply the upstream kernel patch that replaces the plain transport-header reset with the careful transport-header helper and routes unrepresentable offsets through the existing XFRM error drop path; rebuild and deploy the fixed kernel across affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the XFRM code for use of the careful transport-header helper; test with crafted ESP-in-TCP packets and verify that invalid offsets are dropped via the XFRM error path without skb warnings.

Typical attack path

  1. Send specially constructed ESP-in-TCP packets toward a Linux system performing XFRM transformations
  2. Trigger TCP stream parser trimming that invalidates the original transport header offset
  3. Force XFRM to perform a plain transport-header reset resulting in truncation
  4. Observe or induce skb warning path execution and associated packet handling anomalies

How to detect it

Inspect kernel logs and network stack traces for XFRM skb warning messages or unexpected drops on ESP-in-TCP flows; correlate with traffic containing TCP-encapsulated ESP packets.

What your security team should do

  • Prioritize kernel updates on all systems performing IPsec/XFRM processing within the next patch cycle
  • Review network device configurations that enable ESP-in-TCP encapsulation for exposure
  • Monitor kernel logs for XFRM-related skb warnings as an interim detection measure

The record

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. Use the careful transport-header helper and drop the skb through the existing XFRM error path when the offset cannot be represented.

Affected packages

Ecosystem Package Introduced Fixed