CVE-2026-98402 in Linux
Summary
by MITRE • 10/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net: icmp: avoid invalid transport header access in icmp_send tracepoint
syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():
WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline]
WARNING: at udp_hdr include/linux/udp.h:23 [inline]
WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]
WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skb_transport_header include/linux/skbuff.h:3087 [inline]
udp_hdr include/linux/udp.h:23 [inline]
do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline]
trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 __traceiter_icmp_send include/trace/events/icmp.h:11 [inline]
__do_trace_icmp_send include/trace/events/icmp.h:11 [inline]
trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11 __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline]
ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287 dst_link_failure include/net/dst.h:438 [inline]
vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307
TP_fast_assign() unconditionally calls udp_hdr(skb) before checking whether the packet is UDP. Furthermore, __icmp_send() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AF_PACKET) where skb->transport_header was never initialized (~0U).
Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).
Fix this by: 1. Only parsing transport info when iph->protocol == IPPROTO_UDP. 2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2) to safely fetch the UDP header without assuming transport_header is set.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The Linux kernel contains a vulnerability within its Internet Control Message Protocol implementation that results in an invalid access of the network packet buffer's transport layer header information. This issue was identified by syzbot, which triggered a warning via the DEBUG_NET_WARN_ON_ONCE macro during execution of the icmp_send tracepoint. The root cause lies in the unconditional invocation of the udp_hdr function within the TP_fast_assign block of the ICMP send trace event handler. This function attempts to retrieve UDP header data from a socket buffer without first verifying that the packet is actually using the User Datagram Protocol as its transport layer protocol. Consequently, when the kernel processes packets where the transport_header field has not been initialized, typically indicated by a value of ~0U, it leads to an out-of-bounds read or invalid memory access scenario depending on the specific state of the buffer and system configuration.
The vulnerability is particularly exploitable in scenarios involving link failures, ARP errors, packet forwarding operations, or traffic captured via AF_PACKET sockets. In these contexts, the __icmp_send function may be invoked through various code paths where the network stack has not yet parsed or set up the transport layer header pointers within the socket buffer structure. Under configurations that enable DEBUG_NET warnings, such as CONFIG_DEBUG_NET=y, this condition triggers a critical warning because the kernel detects an attempt to access a transport header that was never properly established. This represents a classic instance of improper input validation where the code assumes a certain structural state of network data structures without confirming their validity beforehand. The call trace reveals that this issue propagates from IPv4 route failure handling functions, specifically through ipv4_send_dest_unreach and vti_tunnel_xmit, indicating that tunneling interfaces are also susceptible to triggering this flaw when encountering routing anomalies.
From a security perspective, while the immediate manifestation is often limited to kernel warnings or potential crashes under debug configurations, such invalid memory accesses can potentially be leveraged for denial of service attacks against network services running on affected systems. In more severe cases involving crafted packets designed to exploit the uninitialized header pointers, there could be implications for information disclosure if sensitive data adjacent in memory happens to be read during the malformed access attempt. This vulnerability aligns with CWE-125, which describes out-of-bounds read vulnerabilities resulting from insufficient validation of buffer boundaries and indices before accessing memory locations. It also relates to CWE-94, as it involves improper control of code execution paths due to flawed assumptions about data structure states within the network stack processing logic.
The remediation for this issue requires modifying the icmp_send tracepoint implementation to enforce strict protocol verification before attempting any transport layer parsing. The fix mandates that the kernel should only proceed with extracting UDP header information if the IP header explicitly indicates a protocol value of IPPROTO_UDP. Furthermore, instead of relying on potentially uninitialized pointers via standard helper functions like skb_transport_header, the corrected code utilizes skb_header_pointer to safely fetch data relative to the network offset and IP header length. This approach ensures that memory access remains within valid bounds regardless of whether the transport layer headers have been pre-parsed by earlier stages of packet processing. By decoupling the tracepoint logic from assumptions about internal socket buffer states, the kernel maintains robustness against malformed or unexpected packet flows encountered during routing failures and tunneling operations.
To mitigate risks associated with this vulnerability in environments where patch deployment is delayed, administrators should consider disabling unnecessary ICMP tracing mechanisms if they are not actively required for network diagnostics. Additionally, ensuring that systems running affected kernels have up-to-date security patches applied is the primary defense strategy. Network segmentation strategies can also help limit exposure by restricting which hosts can trigger link failure conditions or send malformed packets to vulnerable interfaces. Monitoring kernel logs for DEBUG_NET warnings may provide early indicators of exploitation attempts in debug-enabled environments, although production systems typically run with these checks disabled to preserve performance. The long-term resolution relies on the upstream Linux community integrating the conditional protocol check and safe header pointer retrieval into stable kernel releases, thereby eliminating the possibility of accessing uninitialized transport headers during ICMP error message generation.