CVE-2026-98852: Linux Kernel IPv6 Extension Header Vulnerability

CVE-2026-98852 Overview

CVE-2026-98852 is a Linux kernel networking vulnerability in the IPv6 extension header detection logic for tunneled packets. The flaw resides in skb_gso_has_extension_hdr() and skb_csum_hwoffload_help(), which incorrectly handle Generic Segmentation Offload (GSO) skbs that carry IPv6 extension headers across encapsulation boundaries. Affected code paths include ip6_gre and ip6_tunnel tunnels that add outer Destination Options headers by default, as well as UDP tunnels such as SCTP-in-UDP and PSP. The result is that valid GSO packets are warned on and dropped by the kernel, producing a networking denial-of-service condition on affected tunnel configurations.

Critical Impact
Legitimate GSO traffic traversing IPv6 tunnels is dropped by the kernel, breaking connectivity for ip6_gre, ip6_tunnel, and UDP tunnel deployments. Unsafe dereference of inner_ip_hdr(skb)->version without skb_header_pointer() adds a memory-safety concern.

Affected Products

Linux kernel versions containing commit c4336a07eb6b ("net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback")
Linux kernel networking stack components net/core/dev.c and GSO handling paths
Deployments using ip6_gre, ip6_tunnel, SCTP-in-UDP, or PSP encapsulation

Discovery Timeline

2026-10-18 - CVE-2026-98852 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98852

Vulnerability Analysis

The vulnerability stems from incomplete handling of IPv6 extension headers across tunnel boundaries. Commit c4336a07eb6b split skb_gso_has_extension_hdr() into mutually exclusive branches based on skb->encapsulation, but did not cover all tunnel paths. When skb->encapsulation is set, the outer header is never checked. IPv6 tunnels such as ip6_gre and ip6_tunnel insert an outer Destination Options header by default through encap_limit. These GSO packets bypass software GSO and reach skb_csum_hwoffload_help(), which then observes the outer extension header and invokes skb_checksum_help() on the GSO skb. That call triggers a warning and drops the packet.

A second defect affects tunnels over IPv6 without an outer transport header. These leave skb->transport_header pointing at the inner transport header, so skb_network_header_len() spans outer IPv6, tunnel, and inner IP headers, producing a false positive. UDP tunnels without an inner network header, such as SCTP-in-UDP or PSP, have no inner IPv6 header to inspect at all.

Root Cause

The root cause is incorrect protocol parsing logic in the GSO extension-header detection path. The code branches on skb->encapsulation without evaluating both outer and inner IPv6 headers using ipv6_ext_hdr(nexthdr). In addition, direct dereference of inner_ip_hdr(skb)->version without skb_header_pointer() is unsafe when the header is not linearly mapped, representing an input validation and memory-safety defect in the kernel networking stack.

Attack Vector

The immediate observable impact is a denial of service against tunneled IPv6 traffic. Network peers emitting GSO packets through ip6_gre, ip6_tunnel, or UDP tunnels encounter kernel warnings and packet drops. Virtio-based paths that construct encapsulated packets without setting skb->encapsulation are also affected. The unsafe dereference of inner header fields raises the possibility of out-of-bounds read behavior on malformed packets reaching the parsing path.

// No verified public exploit code is available for this CVE.
// Refer to the upstream kernel commits for the authoritative patch diff.

Detection Methods for CVE-2026-98852

Indicators of Compromise

Kernel WARN_ON traces originating from skb_checksum_help() in dmesg or journalctl -k output on hosts running IPv6 tunnels
Unexpected drops of GSO packets on ip6gre, ip6tnl, or UDP tunnel interfaces visible via ethtool -S and ip -s link
Degraded throughput on IPv6-encapsulated flows while non-GSO traffic continues to function

Detection Strategies

Query the running kernel version with uname -r and compare against the fixed upstream commits (44ba9dc568c8, 5f0764cb1c81, aa480f05aed7, cabacdf98e09, fdbd83c2d929)
Enable net.core.warnings and collect kernel ring-buffer entries that reference checksum helper paths
Correlate tunnel interface counters with application-level connection failures to isolate GSO-related loss

Monitoring Recommendations

Forward kernel logs to a central telemetry pipeline and alert on repeated skb_checksum_help warnings
Baseline tunnel interface error counters and alert on sustained increases in dropped segments
Track network throughput on IPv6 tunnel endpoints to detect regressions introduced by GSO fallbacks

How to Mitigate CVE-2026-98852

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits once available in your distribution
Audit hosts terminating ip6_gre, ip6_tunnel, SCTP-in-UDP, or PSP tunnels and prioritize them for patching
Verify virtio-backed guests and hypervisors are included in the patch rollout, since encapsulated flows without skb->encapsulation are affected

Patch Information

Fixes are available in the mainline and stable Linux kernel trees. The relevant commits replace the open-coded extension-header checks with ipv6_ext_hdr(nexthdr) evaluated on both outer and inner IPv6 headers, and read headers safely via skb_header_pointer(). See Linux Kernel Commit 44ba9dc568c8, Commit 5f0764cb1c81, Commit aa480f05aed7, Commit cabacdf98e09, and Commit fdbd83c2d929.

Workarounds

Disable NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM offloads on affected interfaces using ethtool -K <iface> tx-udp_tnl-csum-segmentation off
Avoid configuring IPv6 tunnels with default encap_limit Destination Options headers where feasible
Route sensitive workloads over non-IPv6-encapsulated paths until the kernel fix is deployed

bash

# Verify kernel version and disable affected GSO offloads as a temporary workaround
uname -r
ethtool -k eth0 | grep -E 'tx-udp_tnl|tx-gre'
sudo ethtool -K eth0 tx-udp_tnl-csum-segmentation off
sudo ethtool -K eth0 tx-gre-csum-segmentation off