CVE-2026-98532

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: do not let ipv6_find_hdr() return an offset past the packet end

ipv6_find_hdr() walks the extension header chain, skipping each header by

the length that header itself declares. ipv6_optlen() returns up to 2048,

and the skip is never checked against skb->len, so the offset stored in

*offset can point past the end of the packet.

openvswitch installs that offset as the transport header, and

update_ipv6_checksum() then reads and writes the transport checksum field

out of bounds:

BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470

Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629

CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348

Call Trace:

inet_proto_csum_replace16+0x445/0x470

set_ipv6_addr+0x3dd/0x460

do_execute_actions+0x6a3d/0x7c40

ovs_execute_actions+0xfd/0x480

ovs_packet_cmd_execute+0xc38/0xf20

genl_rcv_msg+0x59e/0x870

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References