Linux kernel: Out-of-bounds access in IPv6 extension header parsing
Summary
The IPv6 helper ipv6_find_hdr() in the Linux kernel did not check whether a skipped extension header fits within the packet. The returned offset can point past the end of the packet, and Open vSwitch (OVS) uses it as the transport header, which can lead to out-of-bounds reads and writes of kernel memory. An attacker who can send a crafted IPv6 packet to a host using the OVS kernel datapath could potentially crash the system or corrupt memory; the research notes describe a network-reachable attack with high complexity.
Affected
- Linux kernel from 3.8 up to the fixed stable versions listed below
- Source records for the affected range conflict; the exact range is not fully confirmed.
Fixed in
- Stable kernel versions: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9 and later
- Distribution kernel builds: Unknown; check your distribution advisory.
Workaround
- No vendor workaround known.
- If Open vSwitch is not used on the host, exposure through this path is much lower, but the kernel patch remains the real fix.
Exploitation
- No CISA KEV entry found.
- No public proof-of-concept found in the research; this does not prove that none exists.
- EPSS 0.0022 at the time of listing.
- No known in-the-wild exploitation.
Our recommendation
- Check whether Open vSwitch is installed and used on Linux hosts, especially virtualisation hosts and network appliances.
- Install the kernel update from your distribution once it contains the fix, and verify the build against the vendor advisory.
- If OVS is not in use, handle this through the normal patch cycle.
- Monitor your distribution's security advisories for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 543354c6efb27eae3372a3a9674aeaa2a86e2b2c git.kernel.org
- Linux kernel stable commit ca96b38730e31357ef4a9d76af1336958ac670d7 git.kernel.org
- OSV: CVE-2026-98532 osv.dev
- Ubuntu Security: CVE-2026-98532 ubuntu.com
- VulDB: CVE-2026-98532 vuldb.com
- Vulners NVD listing: CVE-2026-98532 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:46.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares. ipv6_optlen() returns up to 2048, and the skip is never checked against skb->len, so the offset stored in *offset can point past the end of the packet. openvswitch installs that offset as the transport header, and update_ipv6_checksum() then reads and writes the transport checksum field out of bounds: BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470 Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629 CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348 Call Trace: inet_proto_csum_replace16+0x445/0x470 set_ipv6_addr+0x3dd/0x460 do_execute_actions+0x6a3d/0x7c40 ovs_execute_actions+0xfd/0x480 ovs_packet_cmd_execute+0xc38/0xf20 genl_rcv_msg+0x59e/0x870 netlink_rcv_skb+0x18b/0x450 genl_rcv+0x2d/0x40 netlink_unicast+0x6bc/0xa20 The buggy address belongs to the object at ffff88810b754980 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 390 bytes inside of freed 704-byte region [ffff88810b754980, ffff88810b754c40) Other callers use that offset too, so bound it here rather than in one caller. Reject a header whose declared length does not fit in the packet. ipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this adds no new failure mode.
NVD references (8)
- https://git.kernel.org/stable/c/1c70275ca87e769e1a52abc644d61372d8c016cb
- https://git.kernel.org/stable/c/1d42828565889632068fbc2983c34d57c66af4e0
- https://git.kernel.org/stable/c/4254d5878c320c19961dd0b8e1d0aca4800d8b7d
- https://git.kernel.org/stable/c/531255de8971c06d5d5986f85fdc2525d707ba71
- https://git.kernel.org/stable/c/543354c6efb27eae3372a3a9674aeaa2a86e2b2c
- https://git.kernel.org/stable/c/ca96b38730e31357ef4a9d76af1336958ac670d7
- https://git.kernel.org/stable/c/dc92cb972e86790b8078337ec41015b748b8f8e5
- https://git.kernel.org/stable/c/ee319bd3a0e976af5087cbe59ebc50a66f31d202
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.