Read the docs
TI-2026-75698 Aliases CVE-2026-98570GHSA-4prh-wfp5-28j7

net: ipv6: keep room for the mac header in dst_dev_overhead()

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

The Linux kernel IPv6 helper dst_dev_overhead() reserves too little headroom for the MAC header in the seg6, ioam6 and rpl lightweight tunnels. When the MAC header is longer than the reserved space, such as on ingress through a VLAN device with reorder_hdr off, the header rebuild writes past the packet buffer and corrupts memory. Forwarding plain IPv6 traffic through such a device triggers it. Affected Linux kernel versions are from 6.12.16 before 6.13, from 6.13.4 before 6.14, from 5.15.179 before 5.16, from 6.1.130 before 6.2, from 6.6.81 before 6.7, from 5.10.235 before 5.11, and from 6.14 with fixes in 7.2.9 and 7.3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overhead() The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as the length they are about to push plus dst_dev_overhead(), then push the new headers and rebuild the mac header below them with skb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom, but dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac header is longer than that, as it is on ingress through a VLAN device with reorder_hdr off, the rebuild runs out of room: skb_set_mac_header(skb, -skb->mac_len) computes a negative offset, stores it unchecked in the u16 skb->mac_header, and the memmove that follows writes skb->mac_len bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->mac_header comes back as 65534 on a 704-byte head. Return the larger of the two. The helper already returns skb->mac_len when it has no dst, so this only makes the other branch agree, and it covers every caller rather than each call site in turn.

Why it matters now

EPSS 0.00189 8th percentileScored 2026-11-07
Fix Fixed Linux (Linux): 6.13, 6.14, 5.16 +5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.12.16 to before 6.13; 6.13.4 to before 6.14; 5.15.179 to before 5.16; 6.1.130 to before 6.2; 6.6.81 to before 6.7; 5.10.235 to before 5.116.13, 6.14, 5.16, 6.2, 6.7, 5.11Patch availableCNA
LinuxLinux6.14 and later7.2.9, 7.3Patch availableCNA
  • Linux VendorLinux Affected 6.12.16 to before 6.13; 6.13.4 to before 6.14; 5.15.179 to before 5.16; 6.1.130 to before 6.2; 6.6.81 to before 6.7; 5.10.235 to before 5.11 Fixed in 6.13, 6.14, 5.16, 6.2, 6.7, 5.11 Patch available CNA
  • Linux VendorLinux Affected 6.14 and later Fixed in 7.2.9, 7.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

Update the Linux kernel to a fixed version: 5.11, 5.16, 6.2, 6.7, 6.13, 6.14, 7.2.9 or 7.3, depending on the release branch in use.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Linux (Linux) Fixed in 6.13, 6.14, 5.16, 6.2, 6.7, 5.11
  • Fix · CNA Linux (Linux) Fixed in 7.2.9, 7.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 7 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-98570
  2. 2026-10-18 Alias added: GHSA-4prh-wfp5-28j7
  3. 2026-10-19 Fix available: Linux/[email protected] · CNA
  4. 2026-10-20 Affected versions changed · Red Hat
  5. 2026-10-20 CVSS score added · Red Hat
  6. 2026-11-06 Affected versions changed · Red Hat

References

Other 2

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21727 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences