Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98955EUVD-2026-108929

flow_dissector: avoid u16 truncation of skb->len when computing thoff

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.5, 4.10, 4.15, 6.6.160, 6.12.113, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes key_control->thoff using: key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); min_t(u16, ...) casts both arguments to u16 before comparing them. Whenever skb->len (or hlen) modulo 65536 is smaller than nhoff, the truncated length wins and thoff is set to a bogus small value, even when the dissection succeeded. For example, an IPv4/TCP frame with skb->len == 65540 and nhoff == 34 gets thoff == 4, so callers such as skb_probe_transport_header() point the transport header inside the Ethernet header. Such skbs are not exotic: • At the time of commit d0c081b49137 ("flow_dissector: properly cap thoff field"), AF_PACKET with PACKET_VNET_HDR could already build GSO skbs larger than 64KB (MTU checks are skipped for GSO, and alloc_skb_with_frags() accepted up to MAX_SKB_FRAGS (17) order-0 pages on top of the linear part). • BIG TCP now makes skbs larger than 64KB common. • The following patch makes tun_get_user() dissect IFF_TAP frames before eth_type_trans() pulls the Ethernet header, so a GSO frame carrying a 65522..65535 byte L3 packet will be dissected with skb->len in [65536, 65549]. Compare as u32 instead. If the resulting offset cannot be represented in the u16 key_control->thoff, cap it to U16_MAX and report the dissection as failed rather than silently returning a wrong transport offset. thoff is still set on failure, as some callers (such as eth_get_headlen()) use it regardless of the return value.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. Record last updated

Affected versions

  • Linux Linux

    From 4.4.114 · fixed in 4.5; From 4.9.79 · fixed in 4.10; From 4.14.16 · fixed in 4.15

  • Linux Linux

    4.15

  • KernelLinux

    From 4.15.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.11

References 8

git.kernel.org