VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98271: Linux kernel · net: skbuff: do not leave stale header offsets after pskb_carve()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in bff8a8e53a6d290bc2777bde36d3cb6317b8463d : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in bff8a8e53a6d290bc2777bde36d3cb6317b8463d, a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309, 12929ed66a5166177ef5f06d3da81e4f99993e90 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to bff8a8e53a6d290bc2777bde36d3cb6317b8463d, a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309, 12929ed66a5166177ef5f06d3da81e4f99993e90 or 75e4a3e62531738c124c8555a626426fca29d392.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6fa01ccd883021105e9f8af7d04b9f156fa3494a, < bff8a8e53a6d290bc2777bde36d3cb6317b8463d	Fixed in bff8a8e53a6d290bc2777bde36d3cb6317b8463d
LinuxLinux	Affected ≥ 6fa01ccd883021105e9f8af7d04b9f156fa3494a, < a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309	Fixed in a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309
LinuxLinux	Affected ≥ 6fa01ccd883021105e9f8af7d04b9f156fa3494a, < 12929ed66a5166177ef5f06d3da81e4f99993e90	Fixed in 12929ed66a5166177ef5f06d3da81e4f99993e90
LinuxLinux	Affected ≥ 6fa01ccd883021105e9f8af7d04b9f156fa3494a, < 75e4a3e62531738c124c8555a626426fca29d392	Fixed in 75e4a3e62531738c124c8555a626426fca29d392
LinuxLinux	Affected =4.7	Fixed in–

AI-suggested

A fix for this vulnerability has been implemented in the Linux kernel in the commits identified by hashes bff8a8e53a6d290bc2777bde36d3cb6317b8463d, a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309, 12929ed66a5166177ef5f06d3da81e4f99993e90, and 75e4a3e62531738c124c8555a626426fca29d392. Users and administrators should update affected Linux kernel versions to these fixed versions or later to remediate the issue. No additional mitigations are specified or required.

Description

A vulnerability in the Linux kernel's network buffer (skbuff) handling was fixed to prevent stale header offsets after the pskb_carve() operation. The flaw caused header pointers to reference invalid or uninitialized memory regions after packet data was carved, potentially leading to kernel bugs or crashes. The issue was addressed by resetting header offsets and invalidating inner header states to ensure no stale references remain.

Impact

The vulnerability can cause kernel bugs and crashes due to stale header offsets referencing invalid memory after packet carving operations. This can lead to instability or denial of service in affected Linux kernel versions. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.

Summary

CVE-2026-98271 concerns a flaw in the Linux kernel's skbuff subsystem where the functions pskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove bytes from a packet and reallocate skb->head but fail to properly update or reset header offsets such as skb->mac_header, skb->network_header, skb->transport_header, and skb->csum_start. These stale offsets point to bytes that no longer exist or were never initialized, which can cause kernel bugs during skb operations like __skb_pull(). The vulnerability is particularly problematic in pskb_carve_inside_nonlinear(), which can leave a zombie skb with inconsistent header state. The fix involves adding skb_carve_reset_headers() to clear and invalidate all header offsets and inner header states, preventing references to invalid memory. The flaw affects Linux kernel version 4.7 and was resolved in multiple subsequent commits.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:55 UTC

Technical details

References

Community reviews

Related threats