{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98954 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-98954 is a vulnerability in Linux, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-98954 and fix it if it is affected.\n\nWhat it is: CVE-2026-98954 is a vulnerability in Linux, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-98954 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98954/ (Markdown: https://insights.sbomify.com/CVE-2026-98954/index.md)","id":"CVE-2026-98954","markdown":"https://insights.sbomify.com/CVE-2026-98954/index.md","name":"CVE-2026-98954","record":{"aliases":["AZL-110762","BELL-CVE-2026-98954","DEBIAN-CVE-2026-98954","GHSA-27vc-2785-hfjh","UBUNTU-CVE-2026-98954"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: always dissect GSO packets in __virtio_net_hdr_to_skb()\n\nCommit 9e8db5913264 (\"net: avoid false positives in untrusted gso\nvalidation\") added a '\u0026\u0026 skb-\u003enetwork_header' check before flow-dissecting\nGSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM in\n__virtio_net_hdr_to_skb(), because some callers (such as tun_get_user(),\ntun_xdp_one(), virtnet_receive_done(), and raw_verify_header()) called\nvirtio_net_hdr_*_to_skb() before initializing skb-\u003enetwork_header and\nskb-\u003edev.\n\nBecause __alloc_skb() and __build_skb_around() zero-initialize\nskb-\u003enetwork_header to 0 (unlike mac_header and transport_header which\nare initialized to ~0U), those four callers always had\nskb-\u003enetwork_header == 0 and bypassed flow dissection in\n__virtio_net_hdr_to_skb(). More generally, skb-\u003enetwork_header is an\noffset from skb-\u003ehead (where 0 is also a valid offset whenever\nskb_headroom(skb) is 0), not a boolean flag.\n\nWhenever the 'if (gso_type \u0026\u0026 skb-\u003enetwork_header)' branch was skipped,\nthe fallback 'else if (gso_type)' only pulled nh_min_len + thlen (40 bytes\nfor TCPv4) without dissecting the packet, without validating ip_proto or\nn_proto, and without setting skb-\u003etransport_header.\n\nIf the packet has a malformed network header, it is not rejected and a\nsubsequent skb_probe_transport_header() also fails, leaving\nskb-\u003etransport_header at ~0U (0xffff). Similarly, if an IPv4 packet\ncarries IP options (ihl \u003e 5) or an IPv6 packet carries extension headers,\npulling only nh_min_len + thlen can leave the TCP header outside\nskb-\u003ehead. In both cases, tcp_hdrlen(skb) in skb_gso_transport_seglen()\nreads out-of-bounds:\n\n  BUG: KASAN: slab-out-of-bounds in skb_gso_transport_seglen\n  Read of size 2 by task poc/133\n  skb_gso_transport_seglen (net/core/gso.c:155)\n  skb_gso_validate_mac_len (net/core/gso.c:270)\n  tbf_enqueue (net/sched/sch_tbf.c:260)\n  dev_qdisc_enqueue (net/core/dev.c:4227)\n  __dev_queue_xmit (net/core/dev.c:4884)\n\nIn addition, checking virtio_net_hdr_match_proto() only inside\n'if (!skb-\u003eprotocol)' before flow dissection both skipped validation when\nskb-\u003eprotocol was pre-set by the caller and rejected VLAN-tagged frames\nwhose outer L2 protocol is ETH_P_8021Q or ETH_P_8021AD.\n\nFix this by:\n1. Initializing skb-\u003edev and skb-\u003enetwork_header (plus skb-\u003eprotocol for\n   IFF_TUN) before virtio_net_hdr_*_to_skb() in tun_get_user(),\n   tun_xdp_one(), virtnet_receive_done(), and raw_verify_header(). In\n   tun_get_user(), drop the redundant skb_reset_mac_header(skb) in the\n   IFF_TUN case since __virtio_net_hdr_to_skb() unconditionally resets\n   mac_header.\n2. Removing '\u0026\u0026 skb-\u003enetwork_header' and the unvalidated\n   'else if (gso_type)' fallback in __virtio_net_hdr_to_skb() so all GSO\n   packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are flow-dissected, have\n   their transport header pulled into linear data, and have\n   skb-\u003etransport_header set.\n3. Moving the virtio_net_hdr_match_proto() check to after\n   skb_flow_dissect_flow_keys_basic(), validating keys.basic.n_proto\n   against hdr_gso_type.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net: always dissect GSO packets in __virtio_net_hdr_to_skb()","id":"CVE-2026-98954","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"flow_dissector: avoid u16 truncation of skb-\u003elen when computing thoff","id":"CVE-2026-98955"},"packages":[],"prev":{"headline":"devlink: fix devlink_rel reference leak when notify work is pending","id":"CVE-2026-98953"},"products":["Linux"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-23","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-98954/"}