Transport Header Vulnerability in the Linux Kernel

CVE-2026-98401

What is CVE-2026-98401?

A vulnerability in the Linux kernel can lead to a crash when handling encapsulated packets. The problem arises during tunnel decapsulation where the transport header offset is not updated correctly, resulting in a negative offset. This situation can occur under specific conditions when a bridge forwards the inner frame without passing it to the local IP stack. As a result, an invalid read is triggered, which could potentially lead to a denial of service. To mitigate this issue, the transport header should be reset to a sentinel value in tunnel drivers to prevent negative offsets from causing faults.

References