CVE-2026-98402

net: icmp: avoid invalid transport header access in icmp_send tracepoint

State: Published
Severity: Not scored
Published: Oct 14, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: icmp: avoid invalid transport header access in icmp_send tracepoint

syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():

WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline] WARNING: at udp_hdr include/linux/udp.h:23 [inline] WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skb_transport_header include/linux/skbuff.h:3087 [inline] udp_hdr include/linux/udp.h:23 [inline] do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 __traceiter_icmp_send include/trace/events/icmp.h:11 [inline] __do_trace_icmp_send include/trace/events/icmp.h:11 [inline] trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11 __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline] ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287 dst_link_failure include/net/dst.h:438 [inline] vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307

TP_fast_assign() unconditionally calls udp_hdr(skb) before checking whether the packet is UDP. Furthermore, __icmp_send() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AF_PACKET) where skb->transport_header was never initialized (~0U).

Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).

Fix this by: 1. Only parsing transport info when iph->protocol == IPPROTO_UDP. 2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2) to safely fetch the UDP header without assuming transport_header is set.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	524c341cb16a8d5318d2ffacf6fe160271a18743 to before ec6d4612d1c170e1cef1fe55526471da1e81e777Affected 21b28f97e621cba196fb32c576734d216a8a79c9 to before 99654b651c6d5fe865798a2adb859767905f9278Affected db3efdcf70c752e8a8deb16071d8e693c3ef8746 to before b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1Affected db3efdcf70c752e8a8deb16071d8e693c3ef8746 to before 04c0d35bac5122b533672a6775851dfae84e265eAffected db3efdcf70c752e8a8deb16071d8e693c3ef8746 to before 2b32f8c3560905582fb12ed68315a6e606367a6aAffected db3efdcf70c752e8a8deb16071d8e693c3ef8746 to before 7fcc2fe39fed1cb98a7374a113ff3800e8f9af80Affected 6.1.130 to before 6.1.189Affected 6.6.81 to before 6.6.158Affected
LinuxLinux	6.10Affected before 6.10Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

524c341cb16a8d5318d2ffacf6fe160271a18743 to before ec6d4612d1c170e1cef1fe55526471da1e81e777Affected
21b28f97e621cba196fb32c576734d216a8a79c9 to before 99654b651c6d5fe865798a2adb859767905f9278Affected
db3efdcf70c752e8a8deb16071d8e693c3ef8746 to before b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1Affected
db3efdcf70c752e8a8deb16071d8e693c3ef8746 to before 04c0d35bac5122b533672a6775851dfae84e265eAffected
db3efdcf70c752e8a8deb16071d8e693c3ef8746 to before 2b32f8c3560905582fb12ed68315a6e606367a6aAffected
db3efdcf70c752e8a8deb16071d8e693c3ef8746 to before 7fcc2fe39fed1cb98a7374a113ff3800e8f9af80Affected
6.1.130 to before 6.1.189Affected
6.6.81 to before 6.6.158Affected

LinuxLinux

6.10Affected
before 6.10Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.