CVE-2026-98621 Overview
CVE-2026-98621 is a Linux kernel vulnerability in the Generic UDP Encapsulation (GUE) tunneling code. The flaw affects the Remote Checksum Offload (REMCSUM) option handler. When REMCSUM carries a checksum field offset smaller than the checksum start value, gue_remcsum() passes the pair to skb_remcsum_process(), which stores offset - start in the unsigned 16-bit field skb->csum_offset. This subtraction underflows and produces a large positive value.
A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver that trusts the metadata. The result is skb_copy_and_csum_dev() writing two bytes roughly 64 KiB beyond the destination buffer.
Critical Impact
A crafted GUE-encapsulated packet can trigger an out-of-bounds kernel memory write on hosts that forward traffic to hardware-checksum-capable network drivers.
Affected Products
- Linux kernel versions containing the GUE/REMCSUM parsing path prior to the fix commits
- Distributions shipping affected stable kernels (see upstream stable branches referenced in the fix set)
- Systems acting as GUE tunnel endpoints or packet forwarders using NETIF_F_HW_CSUM network interfaces
Discovery Timeline
- 2026-10-18 - CVE-2026-98621 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98621
Vulnerability Analysis
The vulnerability resides in the GUE REMCSUM processing path within the Linux kernel networking stack. REMCSUM is an optimization that lets a tunnel endpoint convey where the inner checksum resides so the receiver can finalize the checksum without full re-computation.
The REMCSUM option carries two values: an absolute checksum start and a checksum field offset. The kernel assumes offset >= start and computes offset - start to populate skb->csum_offset. Because skb->csum_offset is a u16, a reversed tuple produces an integer underflow and wraps to a large value near 65535.
When the packet is forwarded with CHECKSUM_PARTIAL still set and reaches a driver that advertises NETIF_F_HW_CSUM, the driver trusts the attacker-influenced offset. The downstream helper skb_copy_and_csum_dev() then writes two checksum bytes approximately 64 KiB past the end of the destination buffer, corrupting kernel memory [CWE-191, CWE-787].
Root Cause
The root cause is missing ordering validation in validate_gue_flags(). Length checks existed, but no code verified that the REMCSUM offset field is greater than or equal to the start field. The underflow then propagates into checksum metadata that other kernel subsystems treat as trusted.
Attack Vector
An attacker who can deliver GUE-encapsulated UDP packets to a vulnerable host triggers the issue by setting a REMCSUM option where offset < start. On systems that forward the resulting skb to a hardware-checksum-capable NIC, the kernel writes two bytes outside the allocated buffer. The vulnerability is reachable over the network wherever GUE decapsulation is enabled.
No verified proof-of-concept code is published. See the upstream fix commits referenced below for the exact parser changes.
Detection Methods for CVE-2026-98621
Indicators of Compromise
- Unexpected kernel oops, panics, or memory corruption reports on hosts terminating or forwarding GUE tunnels
- Receipt of GUE packets whose REMCSUM option contains a csum_offset numerically smaller than csum_start
- Driver-level warnings from NETIF_F_HW_CSUM NICs about malformed checksum metadata
Detection Strategies
- Inspect UDP traffic destined for configured GUE ports and flag REMCSUM options where the offset field is less than the start field
- Correlate kernel log messages referencing skb_copy_and_csum_dev or checksum-related WARN_ON traces with recent packet captures
- Compare installed kernel build identifiers against the stable fix commits listed in the upstream references
Monitoring Recommendations
- Enable kernel audit and dmesg collection on tunnel endpoints and forwarders, and forward to a central log store
- Monitor crash telemetry (kdump, kernel.panic) from Linux fleet members that process encapsulated traffic
- Track package inventory for kernel versions that remain below the patched baseline
How to Mitigate CVE-2026-98621
Immediate Actions Required
- Apply the upstream kernel patches to all hosts that enable GUE decapsulation or forward GUE traffic
- Reboot patched systems so the fixed kernel is active in memory
- Where patching is delayed, disable GUE tunnel interfaces and block the configured GUE UDP ports at the perimeter
Patch Information
The fix adds ordering validation in validate_gue_flags() so all GUE parsers reject REMCSUM options with reversed start and offset fields in one place. Backports are available in the stable tree. Reference commits: 1d664be, 1eeec0c, 2566866, 40aeafb, 43efb1f, 4b9bc21, 97f9072, and c20f755.
Workarounds
- Remove or down any fou/gue tunnel interfaces on hosts that do not require encapsulation
- Block the UDP ports used for GUE decapsulation at upstream firewalls and host-based filters
- Disable NETIF_F_HW_CSUM offload on affected NICs where feasible to prevent the driver from acting on attacker-controlled checksum metadata
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
