Kernel CVE Batch Analysis: October 18, 2026 (436 CVEs, 10 remote Criticals)

On October 18, 2026 the Linux kernel project published 436 CVEs in a single day — all of them inside 37 minutes of one afternoon. It is the largest wave since the 606 of September 24–25, and it comes with 10 Criticals and 157 entries rated 7.0 or higher.

At analysis time, none of the 436 carried a score from NVD or from the kernel CNA. Every severity in this post is a KernelScan provisional assessment, and NVD may revise it.

The headline is easy to misread. All ten Criticals are network-reachable, and several of their summaries read like “any device with IPv6”. When you check the code, most of them sit behind a tunnel type, a storage protocol or a driver that a typical product does not build. As always, the useful question is not how many there are. It is which of them reach the product you ship.

The batch at a glance

The standouts: ten remote Criticals

IPv6 and tunnels: four Criticals, one of them generic

Four Criticals at 9.8 sit in IPv6 and tunnel code. Each one names a packet from the network as the trigger. They are not equally reachable.

• CVE-2026-98573 (Critical 9.8) is an integer underflow in skb_checksum_setup_ipv6(), which can turn into a very large out-of-bounds copy. The function name suggests every IPv6 device, and the fix sits in core networking code. But it is only reachable through skb_checksum_setup(), and that has exactly two callers in the kernel: the Xen paravirtual network drivers, xen-netback and xen-netfront. In netback the call is on the guest’s transmit path, for packets the guest has flagged for checksum offload. In practice, the attacker is a Xen guest attacking its host, not a remote host sending IPv6. Without CONFIG_XEN_NETDEV_BACKEND or CONFIG_XEN_NETDEV_FRONTEND, the code is not in the build at all.
• CVE-2026-98621 (Critical 9.8) is in GUE, the Generic UDP Encapsulation variant of Foo-over-UDP. A packet with reversed remote-checksum offsets underflows a 16-bit field and later writes two bytes about 64 KiB past a buffer. To be reachable, it needs CONFIG_NET_FOU, an admin-configured GUE receive port, and the packet forwarded to a NIC that trusts checksum metadata. Few products configure that.
• CVE-2026-98570 (Critical 9.8) needs an SRv6, IOAM or RPL lightweight tunnel route, plus ingress through a VLAN device with reorder_hdr off. Under that configuration, forwarding plain ping6 traffic is enough to trigger it. Without one, it is not reachable. Fixes so far are listed only for 7.2.9 and 7.3-rc5.
• CVE-2026-98532 (Critical 9.8) is the generic one. ipv6_find_hdr() walks the extension-header chain and can return an offset past the end of the packet. The demonstrated out-of-bounds write is in Open vSwitch rewriting IPv6 addresses. But more than twenty other callers use the same helper, including ip6tables matches, nftables, tc and IPVS. On a virtual switch, firewall or gateway that inspects IPv6, take this one first. It is fixed in every maintained branch back to 5.10.271.

Storage: the target, the initiator, and the share

CVE-2026-98725 (Critical 9.8) is in the NVMe-over-Fabrics target, in the in-band authentication handshake. A short AUTH_RECEIVE buffer gets a 32-byte write past its end. The handshake runs before the host has authenticated, so the irony is that turning authentication on is what exposes the code. It needs CONFIG_NVME_TARGET_AUTH and a target that offers DH-HMAC-CHAP. It was introduced in 6.0, but fixes are listed only from 6.12.113 up. A 6.1 or 6.6 storage product should check its vendor tree.

CVE-2026-98479 (Critical 9.8) runs the other way. The iSCSI initiator accepts a Data-In PDU for a command that was writing, and copies the target’s bytes into the pages it was about to send. With buffered I/O, pwrite() and fsync() both succeed, nothing is logged, and later reads return the target’s data from the page cache. This is silent data corruption. The attacker is the target you log into, or anyone who can impersonate it on the storage network.

CVE-2026-98454 (Critical 9.1) is the SMB client again, for the third big batch in a row. Malformed create-context chains in a server’s reply make the client read past the buffer. As before, the attacker is the file server you mount. With CONFIG_CIFS=n it is gone.

SCTP, again

CVE-2026-98548 (Critical 9.8) is a use-after-free that a malicious SCTP peer can trigger with a bundled stale-cookie error and a DATA chunk while the association is being set up. Two more SCTP Highs come with it: a timer race (CVE-2026-98586, High 8.1) and a retransmit-path livelock (CVE-2026-98614, High 7.5). The gate is CONFIG_IP_SCTP. That means telecom signaling, Diameter and WebRTC data-channel gateways, and very little else.

Two that come with the hardware

CVE-2026-98597 (Critical 9.8) is in sr9700, the driver for a CoreChips USB 1.1 10/100 Ethernet dongle. A crafted frame on that wire writes past the receive buffer. If you don’t ship the dongle and don’t build CONFIG_USB_NET_SR9700, it is not in your product. If you have open USB ports and a generic kernel, it may be.

CVE-2026-98497 (Critical 9.8) is a logic bug, not memory corruption. With Mellanox ConnectX IPsec hardware offload, IPv6 policies with different source and destination prefix lengths get their masks swapped. The hardware then protects the wrong traffic. It needs the hardware, the offload and that policy shape. Introduced in 6.15.

The high-rated CVEs, grouped by where they bite

Network-reachable: 21 Highs

Ten of them are the Criticals above, and two are the SCTP Highs. The other nine are no broader:

• Storage — an NVMe-oF target bug that snapshots the host ID before it is set, breaking persistent-reservation ownership (CVE-2026-98723, High 8.2, since 6.15), and a netfs read-gap bug that can write stale data back to the server (CVE-2026-98843, High 7.5).
• Tunnels and GSO — unbounded IP-in-IP segmentation recursion that exhausts the kernel stack (CVE-2026-98853, High 7.5), and an IPv6 tunnel checksum-offload path (CVE-2026-98852, High 7.5). Both are denial of service.
• Load balancers and firewalls — IPVS LBLC/LBLCR scheduler caches that an attacker can grow without bound (CVE-2026-98857, High 7.5), and an ip6tables routing-header match that reads past its rule (CVE-2026-98485, High 7.4).
• NICs and VPN — Netronome IPsec offload (CVE-2026-98561, High 8.1), stmmac RX scatter-gather (CVE-2026-98803, High 7.5), and the in-kernel OpenVPN data channel (CVE-2026-98604, High 7.1, since 6.16).

Adjacent: 15 Highs

• 6 Bluetooth and 5 Wi-Fi — on Bluetooth, the top entry is a short L2CAP frame read past its end (CVE-2026-98457, High 8.1), reachable from radio range before pairing. On Wi-Fi, the top entry is CVE-2026-98829 (High 8.8): oversized fragments overflow a length counter in mac80211 reassembly. The frames have to be accepted as part of a link, so the attacker is a peer on the network or the access point, not just anyone in range. Fixes are listed only for 6.18.56, 7.2.10 and 7.3-rc6.
• 4 on the local segment — TIPC cluster encryption reusing AES-GCM nonces (CVE-2026-98805, High 8.1), IPVS sync messages to a backup director (CVE-2026-98794, High 7.1), stmmac RX refill (CVE-2026-98571, High 7.5), and Linux acting as a PCIe NVMe endpoint (CVE-2026-98724, High 7.1).

Local: 121 Highs

This is where most of the batch’s weight sits. 117 of the 121 need only a low-privileged local user, and 74 are races that the attacker has to win.

KVM — 11 Highs out of 28 entries. 10 on x86, 9 on arm64, 5 on s390, 3 on RISC-V and 1 on POWER. Your architecture answers most of them before your config does. Two stand out:

• CVE-2026-98715 (High 8.7) — on AMD hosts, KVM drops a pending TLB flush when VMRUN fails. It has been there since 2.6.38, and fixes are listed only for 7.2.10 and 7.3-rc6.
• CVE-2026-98466 (High 8.8) — on arm64 protected KVM, the hypervisor’s stack pages stay accessible to the host kernel. That breaks pKVM’s promise that the host can’t touch hypervisor memory. It matters for Android-class devices that use pKVM to isolate workloads.

Several of the x86 entries need nested virtualization, which means a guest that runs its own guests.

Bluetooth — 11. Connection-teardown races in the HCI core, ISO channel bugs and a raw HCI socket filter that an unprivileged process can bypass (CVE-2026-98460, High 7.8). Bluetooth sockets only exist in the host’s initial network namespace, so containers can’t reach any of them.

GPU — 9. Six in nouveau alone, plus amdkfd, Imagination and the virtio GPU driver inside guests. A headless product drops all 32 GPU entries on a .config check.

BPF — 9. Verifier bypasses (CVE-2026-98599, High 7.0; CVE-2026-98589, High 7.1), sockmap and trampoline bugs. Most need the right to load BPF programs. Where unprivileged BPF is disabled, which is the default on most distributions, that means CAP_BPF or root.

Core networking, netfilter and tc — 24, three of them in NFC. A packet-socket TX ring use-after-free (CVE-2026-98503, High 7.1), LLC (CVE-2026-98555, High 7.9), SO_RESERVE_MEM on UDP sockets (CVE-2026-98801, High 7.8), flowtable and conntrack-action races. Most need CAP_NET_ADMIN or CAP_NET_RAW. Unprivileged user namespaces hand both to any user.

The rest are mostly hardware-gated: USB, Thunderbolt, TTY and HID (13), NVMe host, block and filesystems (13), NIC drivers (8), and Android binder (2, one of them in the Rust binder that arrived in 6.18).

Appliance triage