CVE-2026-98417

net: xfrm: reject unrepresentable espintcp transport headers

State: Published
Severity: Not scored
Published: Oct 14, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: xfrm: reject unrepresentable espintcp transport headers

ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path.

Use the careful transport-header helper and drop the skb through the existing XFRM error path when the offset cannot be represented.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before d37a5b87577c4b4c1a1dcb000a9dff1df2cf886bAffected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 6c29681207bc213188afa603dff2d55e7178a341Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 4a8243fd2e21980fa3fd10c0610e9155057cebd3Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before b2b84e73e0386ad0b4f9b8d3afde343e761f5275Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 327b2a457dd7d5445f7395f371f3c65de79bd5ceAffected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before cce630c751279e974fa0bb574d80575e0cc7e8f3Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 206f396f46149dc8bc4dfd2b54b9879ba3ee1d7dAffected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 96f01b53c2d05e003b040892256de54a586e8529Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before d37a5b87577c4b4c1a1dcb000a9dff1df2cf886bAffected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 6c29681207bc213188afa603dff2d55e7178a341Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 4a8243fd2e21980fa3fd10c0610e9155057cebd3Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before b2b84e73e0386ad0b4f9b8d3afde343e761f5275Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 327b2a457dd7d5445f7395f371f3c65de79bd5ceAffected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before cce630c751279e974fa0bb574d80575e0cc7e8f3Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 206f396f46149dc8bc4dfd2b54b9879ba3ee1d7dAffected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 96f01b53c2d05e003b040892256de54a586e8529Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.