{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98417","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.347Z","datePublished":"2026-10-14T13:27:47.816Z","dateUpdated":"2026-10-19T09:19:11.040Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-19T09:19:11.040Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xfrm: reject unrepresentable espintcp transport headers\n\nESP-in-TCP can hand xfrm packets whose transport header offset no longer\nfits after the stream parser trims the TCP envelope. The plain transport\nheader reset truncates that offset and triggers the skb warning path.\n\nUse the careful transport-header helper and drop the skb through the\nexisting XFRM error path when the offset cannot be represented."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/espintcp.c"],"versions":[{"version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","lessThan":"d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b","status":"affected","versionType":"git"},{"version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","lessThan":"6c29681207bc213188afa603dff2d55e7178a341","status":"affected","versionType":"git"},{"version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","lessThan":"4a8243fd2e21980fa3fd10c0610e9155057cebd3","status":"affected","versionType":"git"},{"version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","lessThan":"b2b84e73e0386ad0b4f9b8d3afde343e761f5275","status":"affected","versionType":"git"},{"version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","lessThan":"327b2a457dd7d5445f7395f371f3c65de79bd5ce","status":"affected","versionType":"git"},{"version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","lessThan":"cce630c751279e974fa0bb574d80575e0cc7e8f3","status":"affected","versionType":"git"},{"version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","lessThan":"206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d","status":"affected","versionType":"git"},{"version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","lessThan":"96f01b53c2d05e003b040892256de54a586e8529","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/espintcp.c"],"versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.10.271"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"5.15.222"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"6.18.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.2.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.6","versionEndExcluding":"7.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b"},{"url":"https://git.kernel.org/stable/c/6c29681207bc213188afa603dff2d55e7178a341"},{"url":"https://git.kernel.org/stable/c/4a8243fd2e21980fa3fd10c0610e9155057cebd3"},{"url":"https://git.kernel.org/stable/c/b2b84e73e0386ad0b4f9b8d3afde343e761f5275"},{"url":"https://git.kernel.org/stable/c/327b2a457dd7d5445f7395f371f3c65de79bd5ce"},{"url":"https://git.kernel.org/stable/c/cce630c751279e974fa0bb574d80575e0cc7e8f3"},{"url":"https://git.kernel.org/stable/c/206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d"},{"url":"https://git.kernel.org/stable/c/96f01b53c2d05e003b040892256de54a586e8529"}],"title":"net: xfrm: reject unrepresentable espintcp transport headers","x_generator":{"engine":"bippy-1.2.0"}}}}