CVE-2026-98621

A flaw was found in the Linux kernel's Generic UDP Encapsulation (GUE) networking component. A remote attacker could exploit this vulnerability by sending specially crafted network packets containing invalid remote checksum offsets. This improper input validation causes an integer underflow, allowing an out-of-bounds write when the packet is forwarded to certain network device drivers, which can result in memory corruption or a denial of service (DoS) via a system crash.

This vulnerability is rated as Important because remote, unauthenticated attackers can trigger an out-of-bounds memory write, potentially inducing system crashes or kernel instability without prior privileges. The issue stems from insufficient bounds checking in remote checksum handling within Generic UDP Encapsulation tunnels during packet processing. Supported Red Hat Enterprise Linux releases are not affected as the vulnerable code is not present in supported kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.