CVE-2026-98573
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
skb_maybe_pull_tail() resta skb_headlen(skb) del argumento máximo sin signo y pasa el resultado a __pskb_pull_tail() como un int con signo. La función no garantiza que max sea al menos igual a skb_headlen(skb).
Esto puede ocurrir al analizar las cabeceras de extensión de IPv6 cuando un skb ya tiene un área lineal mayor que MAX_IPV6_HDR_LEN.
Leer descripción completaMostrar menos
Una vez que el analizador necesita datos más allá del área lineal, max - skb_headlen(skb) produce un desbordamiento por debajo de cero y se convierte en un delta negativo. A continuación, __pskb_pull_tail() pasa esa longitud negativa a skb_copy_bits(), donde puede convertirse en una longitud de copia muy grande.
Para corregirlo, se pasa la propia longitud solicitada como límite de extracción en los tres puntos de llamada de las cabeceras de extensión, de modo que el delta ya no puede ser negativo.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd
- https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b
- https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78
- https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26
- https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12
- https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6
- https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962
- https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98573",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3",
"lessThan": "9c4e432132a97b82edf28fa172c39f743e6bfb26",
"versionType": "git"
},
{
"status": "affected",
"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3",
"lessThan": "718747afa5463d9cc5fd9a09f03b2a492edd9b78",
"versionType": "git"
},
{
"status": "affected",
"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3",
"lessThan": "a0ad0473c09d2e947aecac5c82e637ec85924b12",
"versionType": "git"
},
{
"status": "affected",
"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3",
"lessThan": "b2da5ed3d8c75e1b729a21b6d3beaed415e263f6",
"versionType": "git"
},
{
"status": "affected",
"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3",
"lessThan": "6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b",
"versionType": "git"
},
{
"status": "affected",
"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3",
"lessThan": "cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962",
"versionType": "git"
},
{
"status": "affected",
"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3",
"lessThan": "d7f474226809471dc7877435e9c492cc914df0bf",
"versionType": "git"
},
{
"status": "affected",
"version": "1431fb31ecbaba1b5718006128f0f2ed0b94e1c3",
"lessThan": "3b4e0b0c008a8c1b474730248cd5b873026c74bd",
"versionType": "git"
}
],
"programFiles": [
"net/core/skbuff.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/skbuff.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:09.587",
"references": [
{
"url": "https://git.kernel.org/stable/c/3b4e0b0c008a8c1b474730248cd5b873026c74bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6c28c31f051dbf49c71ba7ab7bb9bc905fa1d14b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/718747afa5463d9cc5fd9a09f03b2a492edd9b78",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9c4e432132a97b82edf28fa172c39f743e6bfb26",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a0ad0473c09d2e947aecac5c82e637ec85924b12",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b2da5ed3d8c75e1b729a21b6d3beaed415e263f6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cfa643f2ca36c6f913fe1a2ceb12412ebb0fd962",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d7f474226809471dc7877435e9c492cc914df0bf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int. The\nfunction does not ensure that max is at least skb_headlen(skb).\n\nThis can happen while parsing IPv6 extension headers when an skb already\nhas a linear area larger than MAX_IPV6_HDR_LEN. Once the parser needs data\nbeyond the linear area, max - skb_headlen(skb) wraps and is converted to a\nnegative delta. __pskb_pull_tail() then passes that negative length to\nskb_copy_bits(), where it can become a very large copy length.\n\nPass the requested length itself as the pull bound at the three\nextension-header call sites, so the delta can no longer go negative."
}
],
"lastModified": "2026-10-19T10:19:15.453",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}