Cloudanix VulnDB

CVE-2026-98570

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel reserves space for network headers can cause crashes or memory corruption when forwarding certain IPv6 traffic through tunnels and some VLAN setups.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

dst_dev_overhead() under-reserves headroom for skb_mac_header_rebuild() when MAC headers exceed LL_RESERVED_SPACE(), producing a negative mac_header offset stored in a u16 and causing an out-of-bounds memmove ~64 KB past skb->head during seg6, ioam6 or rpl encapsulation.

Why it matters to the business

Forwarding IPv6 traffic through VLAN devices or lwtunnels can trigger kernel memory corruption or crashes, resulting in denial of service on routers, gateways and any system performing encapsulation.

How an attack unfolds

An attacker sends plain IPv6 packets that traverse an egress path using seg6, ioam6 or rpl lwtunnels on a device whose MAC header is longer than 16 bytes (for example a VLAN interface with reorder_hdr disabled); the undersized skb_cow_head() followed by skb_mac_header_rebuild() then performs the out-of-bounds write.

How to fix it

Apply the upstream fix that returns the larger of dst_dev_overhead() and skb->mac_len in dst_dev_overhead(); obtain the corrected kernel from your distribution or compile from the commit that resolves the issue.

How to confirm the fix worked

After patching, forward ping6 traffic through the previously affected seg6/rpl/ioam6 paths on a VLAN-with-reorder_hdr-off device and confirm skb->mac_header is a valid offset and no out-of-bounds writes occur.

Typical attack path

  1. Identify or create a forwarding path that uses seg6/ioam6/rpl encapsulation
  2. Ensure the egress device presents a MAC header larger than LL_RESERVED_SPACE()
  3. Transmit IPv6 packets that trigger the lwtunnel header push and mac-header rebuild
  4. Trigger skb_set_mac_header with negative offset leading to distant write

How to detect it

Search kernel logs for skb_set_mac_header or skb_mac_header_rebuild warnings, oops involving negative mac_header offsets, or repeated crashes on IPv6 forwarding paths; examine netfilter or tunnel debug output for seg6/ioam6/rpl activity preceding the failure.

What your security team should do

  • Prioritize kernel updates on all systems performing IPv6 lwtunnel encapsulation or forwarding
  • Disable reorder_hdr=0 on VLAN interfaces or avoid the affected tunnel modes until patched
  • Monitor for kernel oops or skb corruption logs on routers handling IPv6

The record

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overhead() The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as the length they are about to push plus dst_dev_overhead(), then push the new headers and rebuild the mac header below them with skb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom, but dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac header is longer than that, as it is on ingress through a VLAN device with reorder_hdr off, the rebuild runs out of room: skb_set_mac_header(skb, -skb->mac_len) computes a negative offset, stores it unchecked in the u16 skb->mac_header, and the memmove that follows writes skb->mac_len bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->mac_header comes back as 65534 on a 704-byte head. Return the larger of the two. The helper already returns skb->mac_len when it has no dst, so this only makes the other branch agree, and it covers every caller rather than each call site in turn.

Affected packages

Ecosystem Package Introduced Fixed