{"id":"CVE-2026-98288","published":"2026-10-06T09:18:19.030","lastModified":"2026-10-06T09:18:19.030","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TSO header length truncation\n\nstmmac_tso_xmit() stores the protocol header length returned by\nstmmac_tso_header_size() in a u8. stmmac_tso_valid_packet() admits\nheaders up to 1023 bytes, so a header longer than 255 bytes wraps modulo\n256 (486 becomes 230, 256 becomes 0).\n\nA TCP over IPv6 socket carrying a few hundred bytes of sticky\ndestination/hop-by-hop options makes skb_tcp_all_headers() exceed 255\nwhile staying below the 1023-byte limit, so such an skb reaches\nstmmac_tso_xmit().\n\nWiden proto_hdr_len to unsigned int, which is sufficient since the value\nis bounded by the hardware limit, and adjust the debug print specifier\naccordingly.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/15989abd74f16f44bf953d056b95f1d2fda9b0cd","tags":[]},{"url":"https://git.kernel.org/stable/c/bcf6013c2b4d732c6e4bf4d0f6ae4a18d63d414b","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}