CVE-2026-98271 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: do not leave stale header offsets after pskb_carve()
pskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove the first bytes of a packet and reallocate skb->head.
All the headers that were present before the operation are gone, but both functions call skb_headers_offset_update(skb, 0), which is a no-op : skb->mac_header, skb->network_header, skb->transport_header and skb->csum_start keep their old values and now describe bytes which are no longer there.
Both helpers size the new head from the old skb_end_offset(), so the stale offsets still land inside the new allocation. They point past skb_tail_pointer() though, to bytes that were never initialized.
pskb_carve_inside_nonlinear() is the worst case, because it leaves a zombie skb with an empty linear part (skb->data == skb_tail_pointer(skb), skb_headlen(skb) == 0), while skb_mac_header_was_set() is still true and skb->mac_header is way ahead of skb->data.
The only user of pskb_extract() is rds_tcp_data_recv(), and the carved skb is queued on tinc->ti_skb_list. When the RDS incoming message is released, rds_tcp_inc_free() calls skb_queue_purge(), which frees the skbs with SKB_DROP_REASON_QUEUE_PURGE. This is visible from drop_monitor, which then tries to pull back to the (bogus) mac header :
skbuff: __skb_pull(len=234) skb len=6968 data_len=6968 headroom=0 headlen=0 tailroom=0 end-tail=384 mac=(234,14) mac_len=14 net=(248,40) trans=288 shinfo(txflags=0 nr_frags=1 gso(size=1428 type=16 segs=5)) csum(0x100120 start=288 offset=16 ip_summed=3 complete_sw=0 valid=1 level=0) hash(0x7b446c6c sw=0 l4=1) proto=0x86dd pkttype=0 iif=60 kernel BUG at ./include/linux/skbuff.h:2847!
Add skb_carve_reset_headers() to mark the mac and transport headers as not set, reset the network header, clear skb->mac_len, and drop a now meaningless CHECKSUM_PARTIAL (csum_start no longer describes anything).
Invalidate the inner offsets as well. Unlike mac_header and transport_header they have no "unset" sentinel, so a leftover non-zero value still looks like a real header. Zero skb->inner_mac_header, skb->inner_network_header, skb->inner_transport_header, skb->inner_protocol and skb->encapsulation, so that all the header state is invalidated in one place.
v2: fixed an inaccurate changelog. The stale offsets stay inside the new skb->head, which is never smaller than the old one, they simply point past skb_tail_pointer() to bytes that are gone. Thanks to Xuanqiang Luo for insisting on this. Also invalidate the inner header state, as suggested by the netdev AI review : https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel networking subsystem contains a critical vulnerability within the socket buffer management logic, specifically involving the pskb_carve functions used to manipulate packet data structures. The core issue arises when pskb_carve_inside_header or pssb_carve_inside_nonlinear are invoked to remove initial bytes from a packet and reallocate its head memory area. While these operations successfully adjust the physical layout of the socket buffer by shifting pointers, they fail to update the logical header offset fields stored within the sk_buff structure. Consequently, internal pointers such as mac_header, network_header, transport_header, and csum_start retain their original values despite no longer pointing to valid data within the newly allocated memory space. This discrepancy creates a state where the kernel believes specific protocol headers exist at offsets that are now invalid or point beyond the current tail of the buffer.
This stale header offset condition leads to severe operational instability when subsequent network stack operations attempt to access these headers. The most critical impact is observed in the RDS TCP implementation, which utilizes pskb_extract and subsequently queues the modified socket buffers for processing. When an incoming message is released, the system invokes skb_queue_purge to free the associated sk_buffs. During this cleanup process or during prior packet parsing stages that rely on header offsets, the kernel attempts to pull data back to the bogus mac_header location. Because these offsets point past the actual tail pointer into uninitialized memory regions, it triggers a kernel bug check at include/linux/skbuff.h. This results in an immediate kernel panic or crash, effectively causing a denial of service for any system relying on this specific networking path involving RDS TCP data reception and subsequent buffer purging.
From a vulnerability classification perspective, this flaw represents a classic case of improper state management leading to out-of-bounds access conditions. It aligns with CWE-125 Out-of-bounds Read, as the kernel attempts to interpret memory contents based on stale pointers that exceed valid boundaries. Furthermore, it relates to CWE-824 Access of Uninitialized Memory Variable because the offsets point into regions that have not been properly initialized in the new allocation context. In terms of adversarial tactics, this vulnerability could be leveraged within ATT&CK technique T1059 Command and Scripting Interpreter if an attacker can trigger the specific packet processing path to cause a system crash, thereby disrupting availability services. The lack of proper validation before accessing header fields allows for potential exploitation by sending crafted network packets that force the pskb_carve functions into this erroneous state.
The resolution involves introducing a new helper function named skb_carve_reset_headers which systematically invalidates all stale header states after carving operations are completed. This function explicitly marks mac and transport headers as unset, resets the network header to an undefined state, clears the mac_len field, and drops any meaningful checksum partial data that would otherwise reference non-existent bytes. Crucially, the fix also addresses inner header offsets which lack standard sentinel values for being unset. By zeroing out inner_mac_header, inner_network_header, inner_transport_header, inner_protocol, and encapsulation fields, the kernel ensures a complete reset of all header state metadata associated with the socket buffer. This comprehensive approach prevents any residual data from being misinterpreted as valid protocol headers during subsequent processing stages.
Mitigation strategies for organizations running affected Linux kernels involve applying the upstream kernel patch that includes this fix immediately upon availability. For systems where immediate patching is not feasible, network segmentation can be employed to restrict access to services utilizing RDS TCP or similar protocols that trigger the vulnerable code path until a full system update is performed. Additionally, enabling drop_monitor and other kernel debugging tools can help identify if such malformed packet processing events are occurring in production environments, allowing for proactive detection of exploitation attempts before they result in catastrophic system failures. Regular auditing of network stack configurations and ensuring all networking components are updated to versions containing this specific skbuff correction is essential for maintaining the integrity and availability of Linux-based infrastructure.