CVE-2026-98241
7.8 HIGHPublished 2026-10-06 · Updated 2026-10-07
AI risk analysis
- Summary
- The Linux kernel's IPv6 XFRM implementation has a flaw where error handling callbacks incorrectly assume all socket objects are full IPv6 sockets when processing packets with lower MTU routes. This can lead to memory corruption when mini-sockets from TCP SYN-ACK packets are misinterpreted as full sockets, potentially allowing attackers to execute arbitrary code or cause system crashes.
- Exploitability
- Exploitation is moderately difficult and requires specific conditions involving TCP connections with IPv6 XFRM tunnel routes that trigger PMTU discovery errors, but no public exploit is currently available.
- Blast radius
- If exploited, this vulnerability could affect any Linux system running IPv6 with XFRM tunnels, potentially causing denial of service or arbitrary code execution across network services using these features.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Apply the kernel patch that resolves the socket casting issue in the xfrm6_local_rxpmtu() and xfrm6_local_error() functions, which is part of the 6.12 kernel release.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCP_NEW_SYN_RECV request_sock while the output path itself is driven by the full listener. If rerouting selects an IPv6 XFRM tunnel route with a lower MTU, the local PMTU/error handling path can reach these callbacks with that mini-socket still attached to the skb. The callbacks then miscast the request socket as a full inet/IPv6 socket and can read beyond the request_sock allocation when they access inet_sock or ipv6_pinfo state. Resolve the owner with skb_to_full_sk() in both callbacks and bail out when no full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error logic, which already reasons about full sockets with skb_to_full_sk().
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
All references
- https://git.kernel.org/stable/c/4c030a0400ebfd2318361c923a88103b2c67c49f
- https://git.kernel.org/stable/c/60459c670329d586a58db5d8f811fa5accfe4862
- https://git.kernel.org/stable/c/675919e08ce266b8cac11fd9af29170e762a480f
- https://git.kernel.org/stable/c/6973a21ee73c5567f883813c8ef414774b45892f
- https://git.kernel.org/stable/c/904a0e827d0d7189271a3a2eb648293809f25efc
- https://git.kernel.org/stable/c/b1a88633c36d2cbc3831382f3846754d344276fd
- https://git.kernel.org/stable/c/c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8
- https://git.kernel.org/stable/c/ca3d68c3213475b53db6647e159dc73bd1af5ab1
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-98229
- HIGHCVE-2026-100660PoC
- HIGHCVE-2026-100661PoC
- HIGHCVE-2026-100662PoC
- CRITICALCVE-2026-101980
- HIGHCVE-2026-103262PoC
- CRITICALCVE-2026-103635PoC
- HIGHCVE-2026-103636PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.