CVE-2026-98288
kernel: net: stmmac: fix TSO header length truncation
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 6, 2026
Updated · October 11, 2026
Description
A flaw was found in the Linux kernel's stmmac network driver. A local attacker could exploit this vulnerability to cause a Denial of Service (DoS) by transmitting specially crafted IPv6 packets with large header options. This issue occurs because the driver stores TCP Segmentation Offload (TSO) protocol header lengths in an undersized variable, truncating headers larger than 255 bytes and causing improper packet processing.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-681 · Incorrect Conversion between Numeric Types