# CVE-2026-97984: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

> A local attacker with network privileges can trigger a UDP length integer overflow in the Linux kernel IPv6 stack, causing a warning and potential denial of service.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-104355, BELL-CVE-2026-97984, DEBIAN-CVE-2026-97984, GHSA-5m3w-7wwr-wqm2, UBUNTU-CVE-2026-97984

## What is CVE-2026-97984?

CVE-2026-97984 is a vulnerability in Linux, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

This commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP sockets to
avoid a possible overflow of UDP length that triggers a WARN in
udp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to
IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over
a netdev with an unusually large MTU.

Steps to reproduce (included in the new selftest):

1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be
   set to that MTU in ip6_setup_cork.
2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It
   lets maxnonfragsize be set to device MTU (cork->fragsize) in
   __ip6_append_data, rather than to IP6_MAX_MTU.
3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of
   IPv6 header). Device MTU allows it (it's only one byte bigger than
   IP6_MAX_MTU, and the device MTU is bigger than that).
4. The UDP length in the built packet is 65536, which overflows the
   16-bit length field and triggers the WARN in udp_set_len_short.

To avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit
the change to UDP sockets only.

The original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to
predate git history (verified reproduction on 2.6.21), was fixed later,
and then reappeared in commit 427faee167bc ("net: ipv6: introduce
ip6_dst_mtu_maybe_forward"), which is chosen as the Fixes tag here. The
overflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in
commit 628a5c561890 ("[INET]: Add IP(V6)_PMTUDISC_RPOBE").

## Which versions are affected by CVE-2026-97984?


## How do I fix CVE-2026-97984?

Apply the vendor's patch.

## Is CVE-2026-97984 being exploited?

There is no known exploitation of CVE-2026-97984 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-97984 and fix it if it is affected.

What it is: CVE-2026-97984 is a vulnerability in Linux, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-97984 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-97984/ (Markdown: https://insights.sbomify.com/CVE-2026-97984/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-97984
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97984
- OSV: https://osv.dev/vulnerability/CVE-2026-97984

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-97984/
Summaries are generated and may contain mistakes; the official description above is the record.