CVE-2026-98371: Linux Kernel XFRM IPTFS DoS Vulnerability

CVE-2026-98371 Overview

CVE-2026-98371 is a Linux kernel vulnerability in the xfrm IP-TFS (IP Traffic Flow Security) reassembly path. When an inner packet start is split across two outer IPTFS packets with fewer than 4 bytes landing at the end of the first, __input_process_payload() stores those bytes as a runt and skips the standard iplen/iphlen validation. The subsequent reassembly uses an attacker-controlled inner length, triggering skb_over_panic() and crashing the kernel. The bug was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab.

Critical Impact
Unprivileged local users can crash the kernel through user and network namespaces, and remote attackers can panic IPTFS VPN gateways when the decrypted outer skb is linear.

Affected Products

Linux kernel versions implementing the xfrm IPTFS reassembly path
Systems exposing IPTFS Security Associations through userns+netns
IPTFS VPN gateways receiving linear decrypted skbs through AF_PACKET taps or tun/tap delivery

Discovery Timeline

2026-10-06 - CVE-2026-98371 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-98371

Vulnerability Analysis

The vulnerability resides in the IPTFS reassembly logic that handles inner packets split across outer packet boundaries. When fewer than 4 bytes of an inner packet land at the end of the first outer packet, __input_process_payload() saves them as a runt buffer and defers header validation to the continuation path. The continuation handler iptfs_reassem_cont() only verifies the declared inner length is greater than or equal to sizeof(ra_runt) (6 bytes) before allocating the reassembly skb.

Root Cause

The helper __iptfs_iphlen() returns a fixed minimum IP header size of 20 bytes for IPv4 and 40 bytes for IPv6. For an inner IPv4 tot_len in the range [6, 19], the header-completion copy writes past the declared packet length. The subsequent ipremain -= copylen arithmetic underflows to approximately 4 GB, leaving the payload copy length bounded only by blkoff (up to 64 KB). At runtime the skb_put() tailroom check converts this into skb_over_panic(), producing an unprivileged kernel panic.

Attack Vector

Local unprivileged users can reach the code path by creating IPTFS Security Associations inside user and network namespaces. Remote attackers can target IPTFS VPN gateways when the decrypted outer skb is linear, such as through AF_PACKET taps or tun/tap delivery. Successful exploitation panics the kernel and produces a denial-of-service condition.

The fix aligns the runt path with the normal path by requiring the declared inner length to cover at least the IP header size. This condition subsumes the previous >= sizeof(ra_runt) check, since the minimum IP header is always larger than the runt buffer. See Kernel Git Commit dc33262 for the patch content.

Detection Methods for CVE-2026-98371

Indicators of Compromise

Kernel panic messages referencing skb_over_panic in dmesg or persistent kernel logs
Unexpected reboots on hosts terminating IPTFS Security Associations
Crash dumps containing stack frames from iptfs_reassem_cont or __input_process_payload

Detection Strategies

Audit kernel versions across the fleet to identify hosts running xfrm IPTFS code paths predating the fix commits
Monitor for inner IPTFS fragments with declared tot_len values below the minimum IP header size
Correlate IPTFS SA creation events in unprivileged namespaces with kernel-ring-buffer anomalies

Monitoring Recommendations

Forward kernel logs and crash telemetry to a centralized data lake for correlation across VPN gateways
Alert on repeated skb_over_panic events originating from the same source address or namespace
Track userns and netns creation activity on hosts that do not require unprivileged namespace functionality

How to Mitigate CVE-2026-98371

Immediate Actions Required

Apply the upstream Linux kernel fix referenced in the stable branch commits to all affected hosts
Prioritize patching IPTFS VPN gateways and any host that terminates IPTFS Security Associations
Disable unprivileged user namespaces on systems that do not require them to reduce the local attack surface

Patch Information

The vulnerability is resolved in the following upstream commits:

The fix requires the declared inner length in the runt path to cover at least the IP header size, aligning validation with the in-place packet path.

Workarounds

Restrict creation of unprivileged user namespaces using sysctl kernel.unprivileged_userns_clone=0 where supported
Avoid deploying IPTFS Security Associations on kernels lacking the fix
Limit exposure of IPTFS VPN gateways to trusted peers using firewall and ACL controls until patches are applied

bash

# Disable unprivileged user namespaces to reduce local attack surface
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-harden.conf