CVE-2026-98621 net: gue: reject invalid REMCSUM offsets
An integer underflow in the Linux kernel GUE protocol allows remote attackers to cause memory corruption and potential code execution via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98621?
CVE-2026-98621 is a vulnerability in Linux, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: gue: reject invalid REMCSUM offsets
The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows.
A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer.
Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.
Which versions are affected by CVE-2026-98621?
How do I fix CVE-2026-98621?
Apply the vendor's patch.
Is CVE-2026-98621 being exploited?
There is no known exploitation of CVE-2026-98621 in the wild and no public exploit code.
Sources
Also known as AZL-109034, BELL-CVE-2026-98621, DEBIAN-CVE-2026-98621, GHSA-2cjw-phmm-3745, UBUNTU-CVE-2026-98621.