CVE-2026-98621
Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
net: gue: rechazar desplazamientos REMCSUM no válidos
La opción REMCSUM contiene un inicio de suma de comprobación absoluto y un desplazamiento del campo de suma de comprobación. gue_remcsum() los pasa a skb_remcsum_process(), cuya ruta parcial almacena offset - start en la variable u16 skb->csum_offset. Si offset es menor que start, se produce un desbordamiento por defecto (underflow).
Un paquete reenviado puede conservar CHECKSUM_PARTIAL y llegar a un controlador NETIF_F_HW_CSUM que confía en los metadatos, lo que provoca que skb_copy_and_csum_dev() escriba dos bytes a unos 64 KiB más allá del búfer de destino.
Leer descripción completaMostrar menos
Rechazar las tuplas invertidas en validate_gue_flags(), tras la validación de longitud existente, de modo que todos los analizadores GUE apliquen el orden en un único lugar.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3
- https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b
- https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e
- https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f
- https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad
- https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593
- https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35
- https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98621",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "fe881ef11cf0220f118816181930494d484c4883",
"lessThan": "4b9bc21b2396c396d88dd909caaf73d5be6ff593",
"versionType": "git"
},
{
"status": "affected",
"version": "fe881ef11cf0220f118816181930494d484c4883",
"lessThan": "43efb1f997e976f386aa89716f55870cd2cff9ad",
"versionType": "git"
},
{
"status": "affected",
"version": "fe881ef11cf0220f118816181930494d484c4883",
"lessThan": "1eeec0c51fd5598da44080ed96bbd9880021c28b",
"versionType": "git"
},
{
"status": "affected",
"version": "fe881ef11cf0220f118816181930494d484c4883",
"lessThan": "1d664be4ca49d1696e85239236f4988dfc4653c3",
"versionType": "git"
},
{
"status": "affected",
"version": "fe881ef11cf0220f118816181930494d484c4883",
"lessThan": "97f907203321eee2cc9132d5c9eb47698fb41d35",
"versionType": "git"
},
{
"status": "affected",
"version": "fe881ef11cf0220f118816181930494d484c4883",
"lessThan": "40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f",
"versionType": "git"
},
{
"status": "affected",
"version": "fe881ef11cf0220f118816181930494d484c4883",
"lessThan": "c20f755338ca234e523dfc943719f194dfc1f903",
"versionType": "git"
},
{
"status": "affected",
"version": "fe881ef11cf0220f118816181930494d484c4883",
"lessThan": "2566866fc30965d915d0b52b5c3323b362619f0e",
"versionType": "git"
}
],
"programFiles": [
"include/net/gue.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/gue.h"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:14.997",
"references": [
{
"url": "https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gue: reject invalid REMCSUM offsets\n\nThe REMCSUM option carries an absolute checksum start and checksum field\noffset. gue_remcsum() passes them to skb_remcsum_process(), whose\npartial path stores offset - start in the u16 skb->csum_offset variable.\nIf offset is less than start, this underflows.\n\nA forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM\ndriver which trusts the metadata, leading skb_copy_and_csum_dev() to write\ntwo bytes about 64 KiB beyond the destination buffer.\n\nReject reversed tuples in validate_gue_flags(), after the existing length\nvalidation, so all GUE parsers enforce the ordering in one place."
}
],
"lastModified": "2026-10-19T10:19:26.217",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}