CVE-2026-98621 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
net: gue: reject invalid REMCSUM offsets
The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows.
A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer.
Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel vulnerability identified involves a critical flaw within Generic UDP Encapsulation (GUE) processing logic, specifically concerning the handling of Remote Checksum Offload (REMCSUM) options. The REMCSUM option is designed to carry information regarding absolute checksum start positions and field offsets for hardware-assisted packet verification. When a network interface card supports CHECKSUM_PARTIAL offloading, it relies on metadata provided by the kernel stack to determine where in the packet buffer to write computed checksums. In this specific scenario, the function gue_remcsum() processes these offset values and passes them to skb_remcsum_process(). This internal routine calculates the difference between the field offset and the start position, storing the result as a signed integer that is subsequently cast into an unsigned 16-bit variable named csum_offset within the socket buffer structure.
The core technical flaw arises when the specified checksum field offset is numerically smaller than the absolute checksum start value. Under normal circumstances, this ordering should be invalid because it implies a negative distance between the two points. However, due to integer underflow during the casting process into the unsigned 16-bit type, the resulting csum_offset becomes an extremely large positive number rather than being flagged as an error condition. This erroneous metadata is then propagated through the networking stack without proper validation at this stage, allowing malformed or maliciously crafted packets with reversed offset tuples to bypass initial checks and proceed toward hardware transmission paths.
The operational impact of this vulnerability is severe, particularly in environments where network traffic is forwarded across interfaces that utilize hardware checksum offloading capabilities. When a packet carrying these invalid REMCSUM parameters reaches a driver configured for NETIF_F_HW_CSUM support, the driver trusts the corrupted csum_offset metadata provided by the kernel. Consequently, during the transmission process via skb_copy_and_csum_dev(), the network interface card attempts to write two bytes of checksum data at an address calculated as approximately sixty-four kilobytes beyond the actual destination buffer boundary. This results in a heap-based out-of-bounds write operation, which can lead to memory corruption, kernel panics, or potentially arbitrary code execution if an attacker can control the adjacent memory layout and exploit the overwritten values for further malicious activities.
To mitigate this risk, the resolution involves enforcing strict validation of GUE flag tuples within the validate_gue_flags() function. By rejecting reversed tuples immediately after existing length validations are performed, all subsequent GUE parsers benefit from a centralized enforcement mechanism that ensures checksum start positions always precede or equal field offsets. This prevents the underflow condition from occurring in the first place and stops invalid metadata from reaching hardware drivers. From an industry standards perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write, while its exploitation vector relates to ATT&CK technique T1496 Network Service Scanning if used for reconnaissance or more directly to memory corruption exploits associated with remote code execution. System administrators should apply the latest kernel updates that include this patch to prevent potential compromise of network infrastructure relying on GUE encapsulation and hardware checksum offloading features.