CVE-2026-98271 (GCVE-0-2026-98271)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:45 – Updated: 2026-10-06 08:45
VLAI
Title
net: skbuff: do not leave stale header offsets after pskb_carve()
Summary
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskb_carve() pskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove the first bytes of a packet and reallocate skb->head. All the headers that were present before the operation are gone, but both functions call skb_headers_offset_update(skb, 0), which is a no-op : skb->mac_header, skb->network_header, skb->transport_header and skb->csum_start keep their old values and now describe bytes which are no longer there. Both helpers size the new head from the old skb_end_offset(), so the stale offsets still land inside the new allocation. They point past skb_tail_pointer() though, to bytes that were never initialized. pskb_carve_inside_nonlinear() is the worst case, because it leaves a zombie skb with an empty linear part (skb->data == skb_tail_pointer(skb), skb_headlen(skb) == 0), while skb_mac_header_was_set() is still true and skb->mac_header is way ahead of skb->data. The only user of pskb_extract() is rds_tcp_data_recv(), and the carved skb is queued on tinc->ti_skb_list. When the RDS incoming message is released, rds_tcp_inc_free() calls skb_queue_purge(), which frees the skbs with SKB_DROP_REASON_QUEUE_PURGE. This is visible from drop_monitor, which then tries to pull back to the (bogus) mac header : skbuff: __skb_pull(len=234) skb len=6968 data_len=6968 headroom=0 headlen=0 tailroom=0 end-tail=384 mac=(234,14) mac_len=14 net=(248,40) trans=288 shinfo(txflags=0 nr_frags=1 gso(size=1428 type=16 segs=5)) csum(0x100120 start=288 offset=16 ip_summed=3 complete_sw=0 valid=1 level=0) hash(0x7b446c6c sw=0 l4=1) proto=0x86dd pkttype=0 iif=60 kernel BUG at ./include/linux/skbuff.h:2847! Add skb_carve_reset_headers() to mark the mac and transport headers as not set, reset the network header, clear skb->mac_len, and drop a now meaningless CHECKSUM_PARTIAL (csum_start no longer describes anything). Invalidate the inner offsets as well. Unlike mac_header and transport_header they have no "unset" sentinel, so a leftover non-zero value still looks like a real header. Zero skb->inner_mac_header, skb->inner_network_header, skb->inner_transport_header, skb->inner_protocol and skb->encapsulation, so that all the header state is invalidated in one place. v2: fixed an inaccurate changelog. The stale offsets stay inside the new skb->head, which is never smaller than the old one, they simply point past skb_tail_pointer() to bytes that are gone. Thanks to Xuanqiang Luo for insisting on this. Also invalidate the inner header state, as suggested by the netdev AI review : https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6fa01ccd883021105e9f8af7d04b9f156fa3494a , < 75e4a3e62531738c124c8555a626426fca29d392 (git)
Affected: 6fa01ccd883021105e9f8af7d04b9f156fa3494a , < bff8a8e53a6d290bc2777bde36d3cb6317b8463d (git)
Affected: 6fa01ccd883021105e9f8af7d04b9f156fa3494a , < 12929ed66a5166177ef5f06d3da81e4f99993e90 (git)
Affected: 6fa01ccd883021105e9f8af7d04b9f156fa3494a , < a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309 (git)
Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75e4a3e62531738c124c8555a626426fca29d392",
              "status": "affected",
              "version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
              "versionType": "git"
            },
            {
              "lessThan": "bff8a8e53a6d290bc2777bde36d3cb6317b8463d",
              "status": "affected",
              "version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
              "versionType": "git"
            },
            {
              "lessThan": "12929ed66a5166177ef5f06d3da81e4f99993e90",
              "status": "affected",
              "version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
              "versionType": "git"
            },
            {
              "lessThan": "a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309",
              "status": "affected",
              "version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: do not leave stale header offsets after pskb_carve()\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove\nthe first bytes of a packet and reallocate skb-\u003ehead.\n\nAll the headers that were present before the operation are gone,\nbut both functions call skb_headers_offset_update(skb, 0), which\nis a no-op : skb-\u003emac_header, skb-\u003enetwork_header,\nskb-\u003etransport_header and skb-\u003ecsum_start keep their old values and\nnow describe bytes which are no longer there.\n\nBoth helpers size the new head from the old skb_end_offset(), so the\nstale offsets still land inside the new allocation. They point past\nskb_tail_pointer() though, to bytes that were never initialized.\n\npskb_carve_inside_nonlinear() is the worst case, because it leaves a\nzombie skb with an empty linear part (skb-\u003edata ==\nskb_tail_pointer(skb), skb_headlen(skb) == 0), while\nskb_mac_header_was_set() is still true and skb-\u003emac_header is way\nahead of skb-\u003edata.\n\nThe only user of pskb_extract() is rds_tcp_data_recv(), and the\ncarved skb is queued on tinc-\u003eti_skb_list. When the RDS incoming\nmessage is released, rds_tcp_inc_free() calls skb_queue_purge(),\nwhich frees the skbs with SKB_DROP_REASON_QUEUE_PURGE. This is\nvisible from drop_monitor, which then tries to pull back to the\n(bogus) mac header :\n\nskbuff: __skb_pull(len=234)\nskb len=6968 data_len=6968 headroom=0 headlen=0 tailroom=0\nend-tail=384 mac=(234,14) mac_len=14 net=(248,40) trans=288\nshinfo(txflags=0 nr_frags=1 gso(size=1428 type=16 segs=5))\ncsum(0x100120 start=288 offset=16 ip_summed=3 complete_sw=0 valid=1 level=0)\nhash(0x7b446c6c sw=0 l4=1) proto=0x86dd pkttype=0 iif=60\nkernel BUG at ./include/linux/skbuff.h:2847!\n\nAdd skb_carve_reset_headers() to mark the mac and transport headers\nas not set, reset the network header, clear skb-\u003emac_len, and drop\na now meaningless CHECKSUM_PARTIAL (csum_start no longer describes\nanything).\n\nInvalidate the inner offsets as well. Unlike mac_header and\ntransport_header they have no \"unset\" sentinel, so a leftover\nnon-zero value still looks like a real header. Zero\nskb-\u003einner_mac_header, skb-\u003einner_network_header,\nskb-\u003einner_transport_header, skb-\u003einner_protocol and\nskb-\u003eencapsulation, so that all the header state is invalidated in\none place.\n\nv2: fixed an inaccurate changelog. The stale offsets stay inside the\n    new skb-\u003ehead, which is never smaller than the old one, they\n    simply point past skb_tail_pointer() to bytes that are gone.\n    Thanks to Xuanqiang Luo for insisting on this.\n    Also invalidate the inner header state, as suggested by the\n    netdev AI review :\n    https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T08:45:33.298Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/75e4a3e62531738c124c8555a626426fca29d392"
        },
        {
          "url": "https://git.kernel.org/stable/c/bff8a8e53a6d290bc2777bde36d3cb6317b8463d"
        },
        {
          "url": "https://git.kernel.org/stable/c/12929ed66a5166177ef5f06d3da81e4f99993e90"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"
        }
      ],
      "title": "net: skbuff: do not leave stale header offsets after pskb_carve()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98271",
    "datePublished": "2026-10-06T08:45:33.298Z",
    "dateReserved": "2026-09-25T10:25:14.333Z",
    "dateUpdated": "2026-10-06T08:45:33.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98271",
      "date": "2026-10-22",
      "epss": "0.00175",
      "percentile": "0.06672"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-21T18:35:49.000Z",
      "cve": "CVE-2026-98271",
      "id": "msrc_CVE-2026-98271",
      "initial_release_date": "2026-10-07T01:15:58.000Z",
      "product_status:known_affected": "1",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: skbuff: do not leave stale header offsets after pskb_carve()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98271.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/skbuff.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "75e4a3e62531738c124c8555a626426fca29d392",
                    "status": "affected",
                    "version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bff8a8e53a6d290bc2777bde36d3cb6317b8463d",
                    "status": "affected",
                    "version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "12929ed66a5166177ef5f06d3da81e4f99993e90",
                    "status": "affected",
                    "version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309",
                    "status": "affected",
                    "version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/skbuff.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: do not leave stale header offsets after pskb_carve()\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove\nthe first bytes of a packet and reallocate skb-\u003ehead.\n\nAll the headers that were present before the operation are gone,\nbut both functions call skb_headers_offset_update(skb, 0), which\nis a no-op : skb-\u003emac_header, skb-\u003enetwork_header,\nskb-\u003etransport_header and skb-\u003ecsum_start keep their old values and\nnow describe bytes which are no longer there.\n\nBoth helpers size the new head from the old skb_end_offset(), so the\nstale offsets still land inside the new allocation. They point past\nskb_tail_pointer() though, to bytes that were never initialized.\n\npskb_carve_inside_nonlinear() is the worst case, because it leaves a\nzombie skb with an empty linear part (skb-\u003edata ==\nskb_tail_pointer(skb), skb_headlen(skb) == 0), while\nskb_mac_header_was_set() is still true and skb-\u003emac_header is way\nahead of skb-\u003edata.\n\nThe only user of pskb_extract() is rds_tcp_data_recv(), and the\ncarved skb is queued on tinc-\u003eti_skb_list. When the RDS incoming\nmessage is released, rds_tcp_inc_free() calls skb_queue_purge(),\nwhich frees the skbs with SKB_DROP_REASON_QUEUE_PURGE. This is\nvisible from drop_monitor, which then tries to pull back to the\n(bogus) mac header :\n\nskbuff: __skb_pull(len=234)\nskb len=6968 data_len=6968 headroom=0 headlen=0 tailroom=0\nend-tail=384 mac=(234,14) mac_len=14 net=(248,40) trans=288\nshinfo(txflags=0 nr_frags=1 gso(size=1428 type=16 segs=5))\ncsum(0x100120 start=288 offset=16 ip_summed=3 complete_sw=0 valid=1 level=0)\nhash(0x7b446c6c sw=0 l4=1) proto=0x86dd pkttype=0 iif=60\nkernel BUG at ./include/linux/skbuff.h:2847!\n\nAdd skb_carve_reset_headers() to mark the mac and transport headers\nas not set, reset the network header, clear skb-\u003emac_len, and drop\na now meaningless CHECKSUM_PARTIAL (csum_start no longer describes\nanything).\n\nInvalidate the inner offsets as well. Unlike mac_header and\ntransport_header they have no \"unset\" sentinel, so a leftover\nnon-zero value still looks like a real header. Zero\nskb-\u003einner_mac_header, skb-\u003einner_network_header,\nskb-\u003einner_transport_header, skb-\u003einner_protocol and\nskb-\u003eencapsulation, so that all the header state is invalidated in\none place.\n\nv2: fixed an inaccurate changelog. The stale offsets stay inside the\n    new skb-\u003ehead, which is never smaller than the old one, they\n    simply point past skb_tail_pointer() to bytes that are gone.\n    Thanks to Xuanqiang Luo for insisting on this.\n    Also invalidate the inner header state, as suggested by the\n    netdev AI review :\n    https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com"
          }
        ],
        "id": "CVE-2026-98271",
        "lastModified": "2026-10-19T10:18:28.367",
        "metrics": {},
        "published": "2026-10-06T09:18:16.627",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/12929ed66a5166177ef5f06d3da81e4f99993e90"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/75e4a3e62531738c124c8555a626426fca29d392"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bff8a8e53a6d290bc2777bde36d3cb6317b8463d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-16T01:39:26+00:00",
      "cve": "CVE-2026-98271",
      "id": "CVE-2026-98271",
      "initial_release_date": "2026-10-06T00:00:00+00:00",
      "product_status:known_affected": "249",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: skbuff: do not leave stale header offsets after pskb_carve()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98271.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-09T16:53:26Z",
      "cve": "CVE-2026-98271",
      "id": "CVE-2026-98271",
      "initial_release_date": "2026-10-09T16:53:26Z",
      "product_status:known_affected": "341",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98271",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-98271.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.