CVE-2026-98573

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()

skb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max

argument and passes the result to __pskb_pull_tail() as a signed int. The

function does not ensure that max is at least skb_headlen(skb).

This can happen while parsing IPv6 extension headers when an skb already

has a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data

beyond the linear area, max - skb_headlen(skb) wraps and is converted to a

negative delta. __pskb_pull_tail() then passes that negative length to

skb_copy_bits(), where it can become a very large copy length.

Pass the requested length itself as the pull bound at the three

extension-header call sites, so the delta can no longer go negative.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References