In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff… (CVE-2026-98955)

The Linux kernel's __skb_flow_dissect() function computed key_control->thoff using a min_t(u16, ...) macro, which truncated skb->len to 16 bits before comparison. When skb->len exceeded 65535 bytes, this truncation caused thoff to be set to an incorrect small value, leading to transport header pointers referencing incorrect locations inside the Ethernet header. This issue affected large skbs, which are common due to features like AF_PACKET with PACKET_VNET_HDR, BIG TCP, and certain tun_get_user() frame dissections. The fix involved switching to 32-bit comparisons and capping thoff to U16_MAX when necessary, reporting dissection failure rather than silently returning incorrect offsets.

Incorrect computation of the transport header offset can cause kernel network stack functions to misinterpret packet headers, potentially leading to incorrect packet processing. While the vulnerability does not specify direct exploitation or impact scenarios, it may cause network packet handling errors or instability in affected kernel versions when processing large skbs.

A fix has been implemented in the Linux kernel to address this issue by changing the offset computation to use 32-bit comparisons and capping the offset when it cannot fit in 16 bits. Users should apply the official kernel update that includes this fix. No additional mitigation steps are indicated.