CVE-2026-98621net: gue: reject invalid REMCSUM offsets
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows. A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer. Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from fe881ef11cf0220f118816181930494d484c4883 before 4b9bc21b2396c396d88dd909caaf73d5be6ff593; from fe881ef11cf0220f118816181930494d484c4883 before 43efb1f997e976f386aa89716f55870cd2cff9ad; from fe881ef11cf0220f118816181930494d484c4883 before 1eeec0c51fd5598da44080ed96bbd9880021c28b; from fe881ef11cf0220f118816181930494d484c4883 before 1d664be4ca49d1696e85239236f4988dfc4653c3; from fe881ef11cf0220f118816181930494d484c4883 before 97f907203321eee2cc9132d5c9eb47698fb41d35; from fe881ef11cf0220f118816181930494d484c4883 before 40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f; from fe881ef11cf0220f118816181930494d484c4883 before c20f755338ca234e523dfc943719f194dfc1f903; from fe881ef11cf0220f118816181930494d484c4883 before 2566866fc30965d915d0b52b5c3323b362619f0e | CNA record |
References
- https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593
- https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad
- https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b
- https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3
- https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35
- https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f
- https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903
- https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.