CVE-2026-98485: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98485 Overview

CVE-2026-98485 is an out-of-bounds read vulnerability in the Linux kernel's netfilter IPv6 routing header match module (ip6t_rt). The flaw resides in the rt_mt6_check() and rt_mt6() functions, which fail to validate that rtinfo->addrnr is non-zero when address matching via IP6T_RT_FST_MASK is requested. A crafted IPv6 packet containing matching routing addresses can cause the loop counter i to advance past the IP6T_RT_HOPS bound of 16. Subsequent calls to ipv6_addr_equal() then read beyond the struct ip6t_rt, triggering UBSAN/KASAN warnings or kernel panics.

Critical Impact
An attacker who can send IPv6 packets to a host with a maliciously configured ip6tables rule set can trigger a kernel out-of-bounds read, resulting in kernel memory disclosure or a denial-of-service condition.

Affected Products

Linux kernel (upstream, multiple stable branches)
Distributions shipping the ip6t_rt netfilter module
Systems using ip6tables with IPv6 routing header matching rules

Discovery Timeline

2026-10-18 - CVE-2026-98485 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98485

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the netfilter ip6t_rt match module, which inspects IPv6 Routing Header (Type 0) addresses. The rt_mt6_check() function validates user-supplied match rules but permits rtinfo->addrnr == 0 even when the IP6T_RT_FST_MASK flag indicates that address matching is requested.

At packet-processing time, rt_mt6() iterates through packet routing addresses in the IP6T_RT_FST_NSTRICT (non-strict) code path. The loop termination check if (i == rtinfo->addrnr) break; is placed at the bottom of the loop body. When addrnr is 0 and the first packet address matches rtinfo->addrs[0], the counter i is incremented to 1. Because i is now strictly greater than addrnr, the equality check never evaluates true and the loop never terminates on that condition.

Root Cause

The root cause is a missing input validation combined with a flawed loop termination predicate. Equality comparison (i == rtinfo->addrnr) is unsafe when i may skip past the sentinel value. Once i exceeds IP6T_RT_HOPS (16), index-based access into the fixed-size rtinfo->addrs[] array dereferences memory beyond the structure.

Attack Vector

Exploitation requires two preconditions: an ip6tables rule configured with IP6T_RT_FST_MASK set and addrnr of zero, and a crafted IPv6 packet whose routing header addresses match the first entry in the rule's address array. Attackers meeting these conditions can trigger out-of-bounds reads from kernel memory adjacent to the match rule structure, producing KASAN/UBSAN reports, information disclosure, or kernel panic.

The upstream fix makes two corrections: rt_mt6_check() rejects any rule where IP6T_RT_FST_MASK is set but addrnr is zero, and rt_mt6() moves the i < rtinfo->addrnr test into the for-loop header so bounds are checked before every iteration.

Detection Methods for CVE-2026-98485

Indicators of Compromise

KASAN or UBSAN kernel log messages referencing rt_mt6, ip6t_rt, or ipv6_addr_equal with out-of-bounds read warnings.
Unexpected kernel panics or oops entries in dmesg originating from the ip6_tables or xt_rt code paths.
Presence of ip6tables rules using the rt match with --rt-type 0 and zero configured addresses while non-strict matching is requested.

Detection Strategies

Audit active ip6tables rulesets with ip6tables-save and search for -m rt matches that combine address flags with empty address lists.
Correlate kernel crash telemetry with inbound IPv6 traffic containing Type 0 Routing Headers to identify triggering packets.
Monitor for repeated kernel soft lockups or panics on hosts exposed to IPv6 traffic from untrusted networks.

Monitoring Recommendations

Forward kernel ring buffer and journald logs to a centralized SIEM for pattern matching on KASAN/UBSAN strings.
Enable netfilter counters on rt match rules and alert on unexpected hit rates from external sources.
Track kernel version inventory across the fleet and flag hosts running unpatched stable branches referenced by the upstream commits.

How to Mitigate CVE-2026-98485

Immediate Actions Required

Upgrade to a Linux kernel release that incorporates the upstream fix commits listed in the kernel.org references.
Review all ip6tables rulesets and remove or correct any rt match rule that specifies routing header address matching without a populated address list.
Restrict ingress IPv6 packets containing Routing Header Type 0 at perimeter devices where feasible.

Patch Information

The fix is distributed across multiple stable branches. Relevant upstream commits include Kernel Commit 191239b, Kernel Commit 5a54f8b, Kernel Commit 82313c1, Kernel Commit 959d182, Kernel Commit b892498, Kernel Commit d9cf4ac, Kernel Commit dd55c0e, and Kernel Commit fe336ba. Apply the patch available for your distribution's supported branch.

Workarounds

Unload the ip6t_rt module on systems that do not require IPv6 Routing Header matching: modprobe -r ip6t_rt.
Blacklist the ip6t_rt module via /etc/modprobe.d/ to prevent reload at boot.
Drop IPv6 packets with Routing Header Type 0 at upstream firewalls or on the host using an alternative match that does not trigger the vulnerable code path.

bash

# Prevent the vulnerable module from loading until patched
echo 'blacklist ip6t_rt' | sudo tee /etc/modprobe.d/disable-ip6t_rt.conf
sudo modprobe -r ip6t_rt

# Audit existing ip6tables rules for rt matches
sudo ip6tables-save | grep -- '-m rt'