CVE-2026-98570net: ipv6: keep room for the mac header in dst_dev_overhead()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overhead() The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as the length they are about to push plus dst_dev_overhead(), then push the new headers and rebuild the mac header below them with skb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom, but dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac header is longer than that, as it is on ingress through a VLAN device with reorder_hdr off, the rebuild runs out of room: skb_set_mac_header(skb, -skb->mac_len) computes a negative offset, stores it unchecked in the u16 skb->mac_header, and the memmove that follows writes skb->mac_len bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->mac_header comes back as 65534 on a 704-byte head. Return the larger of the two. The helper already returns skb->mac_len when it has no dst, so this only makes the other branch agree, and it covers every caller rather than each call site in turn.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from dce525185bc92864e5a318040285ee070563fe34 before 36c07127924f11fc5741a780abcaaf808fe9ef13; from dce525185bc92864e5a318040285ee070563fe34 before 87cd6b717e4069dca34e0866e57eaeb44d3b173e; 8471e228448a818e4c27cab4b681b2e758e46cf5; c432cd18a07b623651ed15ea167bd303467004cc; 634710a372ba65bee667c2f6e58a97658c639eab; c447c5a9c47bb4858ab12bf90879fe595d2b7f46; ab9de9c48316d2622d3bf353916b99971570e2c9; 2fcc9f3798ef82399564d247458e69abd10e683b; and 13 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/36c07127924f11fc5741a780abcaaf808fe9ef13
- https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.