CVE-2026-98573

A flaw was found in the Linux kernel. An integer underflow in the networking subsystem allows an attacker to trigger an out-of-bounds memory copy by sending specially crafted Internet Protocol version 6 (IPv6) packets with extension headers. This vulnerability can lead to kernel memory corruption, resulting in a system crash and a Denial of Service (DoS).

Red Hat has evaluated this vulnerability as Important because an unauthenticated network adversary can cause a complete system denial of service without requiring user interaction or prior system access. On typical deployments where IPv6 is active, inbound traffic containing manipulated extension headers triggers an arithmetic miscalculation during network buffer management. This results in an excessively large memory copy that destabilizes the kernel and causes the host to crash. Systems operating with externally accessible IPv6 network interfaces are primarily exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to eliminate pull-bound underflows during socket buffer tail pulls in the kernel networking subsystem: upgrade to the fixed Kernel/Kernel Rt/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds, which pass the requested length itself as the pull bound instead of MAX_IPV6_HDR_LEN at the three extension-header call sites, closing crafted IPv6 packets with extension headers. Until patched, this is a concern on Linux systems running the Linux kernel with IPv6 networking enabled, so restrict network paths from accepting untrusted IPv6 packets with extension headers or disable IPv6 networking where not required. As a compensating measure, deploy runtime memory error detection such as KASAN/HWASan to detect out-of-bounds kernel memory copies when skb_copy_bits reads or writes past buffer boundaries. These controls limit blast radius and contain exploitation, but they do not fix the underlying pull-bound integer underflow defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) (high)