Cloudanix VulnDB

CVE-2026-98621

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A recently fixed flaw in the Linux kernel could let an attacker corrupt memory on systems that handle a certain kind of network packet, potentially crashing machines or allowing code execution.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Invalid REMCSUM offset values in GUE packets cause underflow when computing skb->csum_offset, allowing a later skb_copy_and_csum_dev call on a CHECKSUM_PARTIAL packet to perform a two-byte write far beyond the destination buffer when a NETIF_F_HW_CSUM driver is in use.

Why it matters to the business

Linux systems that process or forward GUE-encapsulated traffic face risk of memory corruption, crashes, or potential remote code execution; the flaw affects kernel networking stacks in routers, hosts, and cloud instances handling this encapsulation.

How an attack unfolds

An attacker crafts a GUE packet containing a REMCSUM option where the checksum-field offset is smaller than the start offset; after length validation the packet is accepted, the underflow populates csum_offset with a huge value, and when the packet reaches a hardware-checksum driver the kernel writes two bytes approximately 64 KiB past the intended buffer.

How to fix it

Apply the upstream kernel commit that adds reversed-tuple rejection inside validate_gue_flags() after length validation; rebuild and deploy kernels containing this check on all affected systems.

How to confirm the fix worked

Inspect the GUE module source for the added ordering test in validate_gue_flags(); confirm that packets with offset < start are now rejected before any checksum metadata is stored.

Typical attack path

  1. Send a forwarded GUE packet with REMCSUM option carrying offset < start
  2. Bypass existing length checks in GUE parsing
  3. Trigger underflow into skb->csum_offset during partial checksum processing
  4. Force the packet to a NETIF_F_HW_CSUM-capable driver
  5. Trigger skb_copy_and_csum_dev to perform out-of-bounds write

How to detect it

Search network-capture or kernel logs for GUE packets carrying the REMCSUM option flag; correlate with subsequent checksum-offload errors or skb corruption warnings in dmesg or netdev logs.

What your security team should do

  • Prioritize kernel updates for any system exposing GUE termination or forwarding
  • Monitor EPSS and exploit-maturity signals for this CVE over the next 30 days
  • Temporarily disable GUE encapsulation where operationally feasible until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows. A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer. Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.

Affected packages

Ecosystem Package Introduced Fixed