CVE-2026-98241

A flaw was found in the Linux kernel's IPv6 IPsec (XFRM) networking framework. When handling TCP connection handshakes routed through an IPsec tunnel with a reduced Maximum Transmission Unit (MTU), the kernel's local error-handling path incorrectly treats incomplete connection request sockets as full network sockets. This improper handling results in an out-of-bounds memory read, allowing an attacker to cause a system crash leading to a Denial of Service (DoS) or potentially leak sensitive kernel memory.

An out of bounds read can occur in the IPv6 XFRM local error path because xfrm6_local_rxpmtu() and xfrm6_local_error() can treat a TCP_NEW_SYN_RECV request socket as a full IPv6 socket. A remote client can create this state by initiating a TCP connection, while an IPv6 XFRM tunnel route with a lower MTU can direct the SYN ACK into the affected PMTU or local error path. Access through inet_sk() or IPv6 socket state can then read beyond the request socket allocation and may cause a kernel crash. For the CVSS the PR:N value is used because the attacker only needs network access to an exposed IPv6 TCP listener and does not require an authenticated account or local execution on the target. AC:H is used because exploitation depends on a specific XFRM tunnel, rerouting, MTU, and socket ownership state. Impact is at least remote denial of service through a kernel fault. The paranoid score allows limited confidentiality impact from the out of bounds read, but no write primitive, UAF, or supported privilege escalation path is established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.