CVE-2026-98271

A flaw was found in the Linux kernel's network subsystem. When trimming or carving network packets, the kernel fails to reset stale header offsets in reallocated socket buffers. A remote attacker could exploit this vulnerability by sending specially crafted network packets, causing packet tracking or cleanup routines to access invalid memory. This flaw leads to a kernel crash, resulting in a Denial of Service (DoS).

Stale SKB header offsets can remain after pskb_carve_inside_header or pskb_carve_inside_nonlinear removes the original packet headers and reallocates skb head. The offsets remain inside the allocation but point beyond skb_tail_pointer to bytes that are no longer part of the packet and were not initialized for the new SKB state. In the demonstrated RDS TCP path the carved SKB is queued and later freed through skb_queue_purge. An active drop_monitor consumer can then use the bogus MAC header offset and reach a kernel BUG in __skb_pull, causing a kernel crash and denial of service. For the CVSS the PR:N value is used because no account or privileges on the target are required when an attacker can communicate as an RDS TCP peer. AV:A and AC:H reflect that RDS TCP is normally used on restricted cluster networks and reliable triggering depends on a specific nonlinear SKB layout, message release, and an active drop monitoring path. The base impact is denial of service only. The paranoid score adds C:L because another SKB metadata consumer could potentially expose uninitialized bytes, but there is no supported UAF, out of bounds write, arbitrary write, or credible privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.