CVE-2026-98621

net: gue: reject invalid REMCSUM offsets

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: gue: reject invalid REMCSUM offsets

The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows.

A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer.

Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fe881ef11cf0220f118816181930494d484c4883 to before 4b9bc21b2396c396d88dd909caaf73d5be6ff593Affected fe881ef11cf0220f118816181930494d484c4883 to before 43efb1f997e976f386aa89716f55870cd2cff9adAffected fe881ef11cf0220f118816181930494d484c4883 to before 1eeec0c51fd5598da44080ed96bbd9880021c28bAffected fe881ef11cf0220f118816181930494d484c4883 to before 1d664be4ca49d1696e85239236f4988dfc4653c3Affected fe881ef11cf0220f118816181930494d484c4883 to before 97f907203321eee2cc9132d5c9eb47698fb41d35Affected fe881ef11cf0220f118816181930494d484c4883 to before 40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57fAffected fe881ef11cf0220f118816181930494d484c4883 to before c20f755338ca234e523dfc943719f194dfc1f903Affected fe881ef11cf0220f118816181930494d484c4883 to before 2566866fc30965d915d0b52b5c3323b362619f0eAffected
LinuxLinux	4.0Affected before 4.0Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

fe881ef11cf0220f118816181930494d484c4883 to before 4b9bc21b2396c396d88dd909caaf73d5be6ff593Affected
fe881ef11cf0220f118816181930494d484c4883 to before 43efb1f997e976f386aa89716f55870cd2cff9adAffected
fe881ef11cf0220f118816181930494d484c4883 to before 1eeec0c51fd5598da44080ed96bbd9880021c28bAffected
fe881ef11cf0220f118816181930494d484c4883 to before 1d664be4ca49d1696e85239236f4988dfc4653c3Affected
fe881ef11cf0220f118816181930494d484c4883 to before 97f907203321eee2cc9132d5c9eb47698fb41d35Affected
fe881ef11cf0220f118816181930494d484c4883 to before 40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57fAffected
fe881ef11cf0220f118816181930494d484c4883 to before c20f755338ca234e523dfc943719f194dfc1f903Affected
fe881ef11cf0220f118816181930494d484c4883 to before 2566866fc30965d915d0b52b5c3323b362619f0eAffected

LinuxLinux

4.0Affected
before 4.0Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.