CVE-2026-98853: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stack. Making inet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP GSO/TSO later made the path reachable. The IPv6 stackable path was introduced separately and uses the same guard. Count IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once per top-level GSO operation and preserved across GRE/UDP context changes. Use the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first five entries pass, and the sixth returns -EINVAL before dispatching another GSO callback.

Засегнати продукти

• Linux Linux: 3347c960295583eee3fd58e5c539fb1972fbc005 преди 388604279da3d0698a151efa4fb6d852efa0de4a; 3347c960295583eee3fd58e5c539fb1972fbc005 преди c949646c900e879afce47df1b607fa320eb63bf2; 3347c960295583eee3fd58e5c539fb1972fbc005 преди 006c8b834aed8b02bd8fb9fb05e9e7ead37d1763
• Linux Linux: 3.13; преди 3.13; 6.18.60 до 6.18.*; 7.2.10 до 7.2.*; от 7.3 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99265
• CVE-2026-99261
• CVE-2026-99260

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-98853
• https://nvd.nist.gov/vuln/detail/CVE-2026-98853
• https://git.kernel.org/stable/c/388604279da3d0698a151efa4fb6d852efa0de4a
• https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2
• https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763