HIGH Introduced in 3.2
ipv6 XfrmError OOB
CVE-2026-98241
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCP_NEW_SYN_RECV request_sock while the output path itself is driven by the full listener. If rerouting selects an IPv6 XFRM tunnel route with a lower MTU, the local PMTU/error handling path can reach these callbacks with that mini-socket still attached to the skb. The callbacks then miscast the request socket as a full inet/IPv6 socket and can read beyond the request_sock allocation when they access inet_sock or ipv6_pinfo state. Resolve the owner with skb_to_full_sk() in both callbacks and bail out when no full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error logic, which already reasons about full sockets with skb_to_full_sk().
02KernelScan AI Analysis
Risk summary
A remote, unauthenticated attacker can trigger an out-of-bounds read in the IPv6 XFRM error-handling path by sending TCP traffic to a host configured with IPv6 IPsec tunnel routing. The read leaks kernel slab memory and may occasionally crash the kernel. Systems without IPv6 XFRM tunnels or without network exposure are not affected.
Vulnerability analysis
When a server replies to a TCP connection attempt and the response is routed through an IPv6 IPsec tunnel with a smaller path MTU, the kernel's error and path-MTU handling assumes the packet is backed by a full network socket. During the TCP handshake, however, the packet can instead be owned by a smaller temporary handshake object. Treating that temporary object as a full socket causes the kernel to read past its allocated memory into neighboring heap space, exposing other kernel data or causing a crash. The fix checks whether a full socket is present before proceeding, and skips the callback when only the handshake object is attached. This matches how related code in the same area already handles the situation. Any remote attacker can reach the bug by sending TCP traffic to a system that has IPv6 IPsec tunnel routing in place; no privileges or user interaction are needed beyond that.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.2 | 5.10.271 | b1a88633c36d |
| 5.15 | 3.2 | 5.15.222 | 904a0e827d0d |
| 6.1 | 3.2 | 6.1.189 | 675919e08ce2 |
| 6.6 | 3.2 | 6.6.158 | 60459c670329 |
| 6.12 | 3.2 | 6.12.112 | ca3d68c32134 |
| 6.18 | 3.2 | 6.18.54 | 4c030a0400eb |
| 7.2 | 3.2 | 7.2.8 | c21f3f7fbfed |
| mainline | 3.2 | 7.3-rc4 | 6973a21ee73c |