Linux Kernel Transport Header Vulnerability in ESP-in-TCP

CVE-2026-98417

What is CVE-2026-98417?

A vulnerability within the Linux kernel's handling of ESP-in-TCP transport headers has been identified. This flaw occurs when xfrm packets have transport header offsets that become unrepresentable after the TCP envelope has been trimmed by the stream parser. Consequently, a plain transport header reset shortens that offset, which leads to the triggering of a warning path in the socket buffer (skb). To mitigate this issue, it is advisable to utilize the appropriate transport-header helper and implement the existing XFRM error path, ensuring that any packet with an unrepresentable offset is discarded. This resolution helps to enhance the stability and security of network communications utilizing this protocol.

References