CVE-2026-98417
priority · track · 0EPSS 0.002 · 12 %ileDEFREPSS · scored 2026-10-22
In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path. Use the careful transport-header helper and drop the skb through the existing XFRM error path when the offset cannot be represented.
cvss
Technical severity, 0–10. One row per scoring source.
No CVSS score recorded.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3951Linux Kernel: Mehrere SchwachstellenDeutsch2026-10-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise einen Denial-of-Service-Angriff auszulösen, Daten zu manipulieren oder offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
- CERTFR-2026-AVI-1374Multiples vulnérabilités dans le noyau Linux de DebianFrançais2026-10-23vendor · certfrFR
- CERTFR-2026-AVI-1375Multiples vulnérabilités dans le noyau Linux de Debian LTSFrançais2026-10-23vendor · certfrFR
sources
Which sources assert this record, and when.
references (8) nvd
External citations — patches, advisories, analysis.
- https://git.kernel.org/stable/c/206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d
- https://git.kernel.org/stable/c/327b2a457dd7d5445f7395f371f3c65de79bd5ce
- https://git.kernel.org/stable/c/4a8243fd2e21980fa3fd10c0610e9155057cebd3
- https://git.kernel.org/stable/c/6c29681207bc213188afa603dff2d55e7178a341
- https://git.kernel.org/stable/c/96f01b53c2d05e003b040892256de54a586e8529
- https://git.kernel.org/stable/c/b2b84e73e0386ad0b4f9b8d3afde343e761f5275
- https://git.kernel.org/stable/c/cce630c751279e974fa0bb574d80575e0cc7e8f3
- https://git.kernel.org/stable/c/d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan