Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98955

flow_dissector: avoid u16 truncation of skb->len when computing thoff

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes key_control->thoff using: key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); min_t(u16, ...) casts both arguments to u16 before comparing them. Whenever skb->len (or hlen) modulo 65536 is smaller than nhoff, the truncated length wins and thoff is set to a bogus small value, even when the dissection succeeded. For example, an IPv4/TCP frame with skb->len == 65540 and nhoff == 34 gets thoff == 4, so callers such as skb_probe_transport_header() point the transport header inside the Ethernet header. Such skbs are not exotic: - At the time of commit d0c081b49137 ("flow_dissector: properly cap thoff field"), AF_PACKET with PACKET_VNET_HDR could already build GSO skbs larger than 64KB (MTU checks are skipped for GSO, and alloc_skb_with_frags() accepted up to MAX_SKB_FRAGS (17) order-0 pages on top of the linear part). - BIG TCP now makes skbs larger than 64KB common. - The following patch makes tun_get_user() dissect IFF_TAP frames before eth_type_trans() pulls the Ethernet header, so a GSO frame carrying a 65522..65535 byte L3 packet will be dissected with skb->len in [65536, 65549]. Compare as u32 instead. If the resulting offset cannot be represented in the u16 key_control->thoff, cap it to U16_MAX and report the dissection as failed rather than silently returning a wrong transport offset. thoff is still set on failure, as some callers (such as eth_get_headlen()) use it regardless of the return value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d0c081b49137cd3200f2023c0875723be66e7ce5 to < d9e08836d06c84abb18470c94b12b131eaccdc7daffected
  • d0c081b49137cd3200f2023c0875723be66e7ce5 to < 50d0cd575cab763f833d6ac6eb6550b23a0b3daeaffected
  • d0c081b49137cd3200f2023c0875723be66e7ce5 to < 9993e6a0ac1b5b3101ffba702cacb9f42b9909d8affected
  • d0c081b49137cd3200f2023c0875723be66e7ce5 to < 52efce4755a4b8b82039caa773645ffc80b25362affected
  • d0c081b49137cd3200f2023c0875723be66e7ce5 to < 99bda1ecbd56905f8bd934b9cdccd3bd251192b1affected
  • d35cd5e279881ec36ff8cd82a2d9caebc0cce3fcaffected
  • eecfa2eeefe3caef4c8d6b2284f6066c76ab26a1affected
  • 80f327285cab6ab8e10c3ea03278add5dd99fb02affected
  • 4.4.114 to < 4.5affected
  • 4.9.79 to < 4.10affected
  • 4.14.16 to < 4.15affected

Linux Linux

Default version status: affected

  • 4.15affected
  • 0 to < 4.15unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.113 to ≤ 6.12.*unaffected
  • 6.18.57 to ≤ 6.18.*unaffected
  • 7.2.11 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References