CVE-2026-98570

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: keep room for the mac header in dst_dev_overhead()

The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as

the length they are about to push plus dst_dev_overhead(), then push the

new headers and rebuild the mac header below them with

skb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom,

but dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,

16 bytes for plain Ethernet.

Where the mac header is longer than that, as it is on ingress through a

VLAN device with reorder_hdr off, the rebuild runs out of room:

skb_set_mac_header(skb, -skb->mac_len) computes a negative offset,

stores it unchecked in the u16 skb->mac_header, and the memmove that

follows writes skb->mac_len bytes about 64 KB past skb->head.

Forwarding plain ping6 traffic through such a device reproduces it on

all five seg6 encapsulation modes and on the rpl and ioam6 inline paths;

skb->mac_header co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References