Cloudanix VulnDB

CVE-2026-98955

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent Linux kernel bug can make the system mishandle very large network packets and potentially crash or corrupt data during routine network processing.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

u16 truncation in __skb_flow_dissect() computes an invalid key_control->thoff for skbs with len > 65535, causing transport header to be placed inside the Ethernet header or other incorrect locations and silently failing dissection.

Why it matters to the business

Recent kernel flaw can destabilize networking stacks handling large or GSO packets, leading to crashes, misrouted traffic, or degraded performance on systems using BIG TCP, tun/tap, or AF_PACKET.

How an attack unfolds

An attacker crafts or forwards IPv4/TCP GSO frames sized so skb->len modulo 65536 is smaller than nhoff; the resulting bogus thoff is consumed by callers such as skb_probe_transport_header(), producing invalid pointer arithmetic that can corrupt memory or crash the kernel.

How to fix it

Update to a kernel containing the u32 comparison and U16_MAX cap for thoff; rebuild and reboot affected systems; until patches are available, avoid configurations that produce skbs >64 KB (disable BIG TCP or GSO where feasible).

How to confirm the fix worked

Inspect flow_dissector.c for the min_t(u32, ...) change and U16_MAX guard; run kernel selftests that exercise >64 KB GSO skbs and confirm thoff is either correct or dissection fails with thoff capped.

Typical attack path

  1. Send or induce a GSO skb whose length is in [65536, 65549] or larger with nhoff near the transport header
  2. Trigger __skb_flow_dissect via packet reception, tun_get_user, or AF_PACKET path
  3. Observe truncated thoff value used by transport-header probing or eth_get_headlen
  4. Induce invalid pointer dereference or memory corruption in subsequent skb processing

How to detect it

Search kernel logs for oops or warnings mentioning skb_flow_dissect, thoff, or skb_probe_transport_header; monitor for unexpected crashes in networking paths shortly after large packet reception.

What your security team should do

  • Apply the upstream fix within the next maintenance window given the two-day publication age
  • Audit systems for BIG TCP or high-MTU GSO usage and prioritize those hosts
  • Add kernel crash and flow_dissector error logging to SIEM for rapid detection of related panics

The record

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes key_control->thoff using: key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); min_t(u16, ...) casts both arguments to u16 before comparing them. Whenever skb->len (or hlen) modulo 65536 is smaller than nhoff, the truncated length wins and thoff is set to a bogus small value, even when the dissection succeeded. For example, an IPv4/TCP frame with skb->len == 65540 and nhoff == 34 gets thoff == 4, so callers such as skb_probe_transport_header() point the transport header inside the Ethernet header. Such skbs are not exotic: - At the time of commit d0c081b49137 ("flow_dissector: properly cap thoff field"), AF_PACKET with PACKET_VNET_HDR could already build GSO skbs larger than 64KB (MTU checks are skipped for GSO, and alloc_skb_with_frags() accepted up to MAX_SKB_FRAGS (17) order-0 pages on top of the linear part). - BIG TCP now makes skbs larger than 64KB common. - The following patch makes tun_get_user() dissect IFF_TAP frames before eth_type_trans() pulls the Ethernet header, so a GSO frame carrying a 65522..65535 byte L3 packet will be dissected with skb->len in [65536, 65549]. Compare as u32 instead. If the resulting offset cannot be represented in the u16 key_control->thoff, cap it to U16_MAX and report the dissection as failed rather than silently returning a wrong transport offset. thoff is still set on failure, as some callers (such as eth_get_headlen()) use it regardless of the return value.

Affected packages

Ecosystem Package Introduced Fixed