high · CVSS v3 7.1

CVE-2026-98621

CVE-2026-98621 is a high‑severity Linux kernel vulnerability that allows an attacker to trigger a buffer overflow by sending a GUE packet wi

Overview

CVE-2026-98621 is a high‑severity Linux kernel vulnerability that allows an attacker to trigger a buffer overflow by sending a GUE packet with an invalid REMCSUM offset. The flaw causes an underflow in the checksum offset handling, leading to a write beyond the destination buffer and potential denial of service or privilege escalation. It can be exploited via crafted network traffic on affected systems.

Description

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows. A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer. Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.

Impact

The vulnerability can corrupt kernel memory, causing a crash or enabling privilege escalation. It affects all Linux kernel users that process GUE packets, especially those with hardware checksum offloading enabled. Defenders should monitor for anomalous network traffic and be prepared to mitigate the impact.

Remediation

Apply the latest kernel update that includes the CVE‑2026‑98621 fix. If patching is delayed, disable GUE support or hardware checksum offloading on affected interfaces, or drop packets containing the REMCSUM option using firewall rules.

Risk context

High severity with a CVSS v3 score of 7.1 indicates a significant risk. No EPSS data is available, but the flaw can be triggered by network traffic, so timely patching is recommended.

Affected products

  • Linux kernel

Scores

Severity
high
CVSS v2
5.6
CVSS v3
7.1
CVSS v4
—
EPSS
—

kernel buffer-overflow checksum GUE network high-severity Linux

← All CVEs

Related CVEs

high

CVE-2026-98788

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize poll_state_synchronize_rcu(mm->futex.phash.batches) is used by futex_ref_drop() to check that a grace period has passed since the current hash was published. This relies on batches referencing a grace period which started after the hash pointer was assigned. __futex_pivot_hash() sets mmph->batches before it replaces mmph->hash: scoped_guard(rcu) { mmph->batches = get_state_synchronize_rcu(); rcu_assign_pointer(mmph->hash, new); } The scoped_guard(rcu) doesn't stop new grace periods from starting, and if one starts between those two assignments, futex_ref_drop() can move forward while a reader still holds a pointer to the old hash. Fix things by setting mmph->batches after assigning mmph->hash. The scoped_guard(rcu) isn't needed, so let's drop that as well.

View analysis

high

CVE-2026-98858

In the Linux kernel, the following vulnerability has been resolved: io_uring: fix task_work add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs task_work off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscq_push() has published it. If that was the last request holding the ring alive, io_ring_exit_work() then frees the ctx, stops the thread, and with it the tctx, while io_req_normal_work_add() is still looking at both after the push: BUG: KASAN: slab-use-after-free in io_req_normal_work_add+0x439/0x510 Read of size 4 at addr ff11000000ca0000 by task repro/55 (...) BUG: KASAN: slab-use-after-free in queue_work_on+0x25/0x70 Write of size 8 at addr ff11000000c3bd00 by task repro/55 Hold an RCU read lock across the add, like io_req_local_work_add() already does, and have io_ring_exit_work() wait for a grace period for SQPOLL rings as well before freeing the ctx.

View analysis

high

CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in kill_rules() kill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit tree is pruned. It drops entry->rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been installed with AUDIT_ADD_RULE, which requires CAP_AUDIT_CONTROL, removing the watched directory can race with another task that is still evaluating the rule. In that case, fsnotify can free the executable mark before the reader reaches audit_mark_compare(), causing a use-after-free. KASAN reports: BUG: KASAN: slab-use-after-free in audit_mark_compare+0x8d/0xa0 Unlink the published rules from the RCU-visible lists and retain them on tree->rules for cleanup. If any rule has an executable mark, wait for a single RCU grace period before removing the marks and scheduling the entries for freeing. Otherwise, call_rcu() already provides the required deferred freeing without a synchronous wait.

View analysis

high

CVE-2026-98625

A use‑after‑free occurs in the Linux kernel netfilter flowtable when a flow is marked HW_DEAD before clearing HW_PENDING, allowing RCU to free the object while a worker still accesses it. This flaw can lead to memory corruption or crashes in systems that use flow offloading. It affects all Linux kernel versions prior to the patch that moves HW_DEAD publication to the worker epilogue.

View analysis