{"id":"CVE-2026-98241","published":"2026-10-06T09:18:12.090","lastModified":"2026-10-07T07:17:05.957","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: xfrm: use full sockets in local error paths\n\nxfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it\nalways pointed at a full IPv6 socket.\n\nThat is not guaranteed. TCP SYN-ACK skbs can be owned by a\nTCP_NEW_SYN_RECV request_sock while the output path itself is driven by the\nfull listener. If rerouting selects an IPv6 XFRM tunnel route with a lower\nMTU, the local PMTU/error handling path can reach these callbacks with that\nmini-socket still attached to the skb.\n\nThe callbacks then miscast the request socket as a full inet/IPv6 socket and\ncan read beyond the request_sock allocation when they access inet_sock or\nipv6_pinfo state.\n\nResolve the owner with skb_to_full_sk() in both callbacks and bail out when\nno full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error\nlogic, which already reasons about full sockets with skb_to_full_sk().","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/4c030a0400ebfd2318361c923a88103b2c67c49f","tags":[]},{"url":"https://git.kernel.org/stable/c/60459c670329d586a58db5d8f811fa5accfe4862","tags":[]},{"url":"https://git.kernel.org/stable/c/675919e08ce266b8cac11fd9af29170e762a480f","tags":[]},{"url":"https://git.kernel.org/stable/c/6973a21ee73c5567f883813c8ef414774b45892f","tags":[]},{"url":"https://git.kernel.org/stable/c/904a0e827d0d7189271a3a2eb648293809f25efc","tags":[]},{"url":"https://git.kernel.org/stable/c/b1a88633c36d2cbc3831382f3846754d344276fd","tags":[]},{"url":"https://git.kernel.org/stable/c/c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8","tags":[]},{"url":"https://git.kernel.org/stable/c/ca3d68c3213475b53db6647e159dc73bd1af5ab1","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's IPv6 XFRM implementation has a flaw where error handling callbacks incorrectly assume all socket objects are full IPv6 sockets when processing packets with lower MTU routes. This can lead to memory corruption when mini-sockets from TCP SYN-ACK packets are misinterpreted as full sockets, potentially allowing attackers to execute arbitrary code or cause system crashes.","exploitability":"Exploitation is moderately difficult and requires specific conditions involving TCP connections with IPv6 XFRM tunnel routes that trigger PMTU discovery errors, but no public exploit is currently available.","blast_radius":"If exploited, this vulnerability could affect any Linux system running IPv6 with XFRM tunnels, potentially causing denial of service or arbitrary code execution across network services using these features.","remediation":"Apply the kernel patch that resolves the socket casting issue in the xfrm6_local_rxpmtu() and xfrm6_local_error() functions, which is part of the 6.12 kernel release.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","ipv6","xfrm","memory-corruption","denial-of-service"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:05:11.196Z"}}