CRITICAL Introduced in 4.0
gue Remcsum Underflow
CVE-2026-98621
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows. A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer. Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.
02KernelScan AI Analysis
Risk summary
Systems with GUE (Generic UDP Encapsulation) tunnels enabled are at risk from remote attackers who can send crafted packets. A malicious GUE packet with reversed REMCSUM offsets triggers an integer underflow that corrupts kernel memory beyond a network buffer, potentially allowing remote code execution or kernel crash.
Vulnerability analysis
The GUE tunneling code processes a REMCSUM option that carries two offset values: a checksum start position and a checksum field offset. When the field offset is smaller than the start position, the subtraction used to compute the checksum offset underflows in a 16-bit variable, producing a very large value. If such a packet is forwarded through an interface with hardware checksum offload, the driver trusts this corrupted metadata and writes two bytes roughly 64 KiB past the end of the destination buffer. The fix adds a validation check in the shared GUE flag parser to reject any REMCSUM option where the field offset precedes the start offset, closing the vulnerability for all GUE parsers in one place. An attacker only needs to transmit a single malformed GUE packet to a listening endpoint; no authentication, local access, or special privileges are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.0 | 5.10.271 | 4b9bc21b2396 |
| 5.15 | 4.0 | 5.15.222 | 43efb1f997e9 |
| 6.1 | 4.0 | 6.1.189 | 1eeec0c51fd5 |
| 6.12 | 4.0 | 6.12.112 | 97f907203321 |
| 6.18 | 4.0 | 6.18.55 | 40aeafbcbc7b |
| 6.6 | 4.0 | 6.6.158 | 1d664be4ca49 |
| 7.2 | 4.0 | 7.2.9 | c20f755338ca |
| mainline | 4.0 | 7.3 | 2566866fc309 |
| cip/5.10 | 4.0 | 5.10.271-cip78 | 4b9bc21b2396 |
| cip/6.1 | 4.0 | 6.1.189-cip61 | 1eeec0c51fd5 |
| cip/6.1-rt | 4.0 | 6.1.189-cip61-rt32 | 1eeec0c51fd5 |
| cip/6.12 | 4.0 | 6.12.112-cip33 | 97f907203321 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.112-cip33 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |