In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end… (CVE-2026-98532)

The Linux kernel vulnerability (CVE-2026-98532) involves the ipv6_find_hdr() function, which walks the IPv6 extension header chain by skipping headers according to their declared length. The function ipv6_optlen() can return lengths up to 2048, but the skip is not checked against the actual packet length (skb->len). Consequently, the offset stored can point past the packet end. This leads to out-of-bounds memory access when openvswitch installs this offset as the transport header and update_ipv6_checksum() reads and writes the transport checksum field beyond the packet boundary. The kernel's KASAN detected a slab-use-after-free error triggered by this flaw. The fix bounds the offset within the packet to prevent such invalid memory accesses, rejecting headers with lengths that do not fit within the packet. No new failure modes were introduced as ipv6_find_hdr() already fails on malformed header chains.

This vulnerability can cause out-of-bounds memory access in kernel space, leading to use-after-free conditions and potential kernel crashes or memory corruption. It affects kernel components that rely on ipv6_find_hdr() for header parsing, such as openvswitch, which may read or write beyond allocated memory. While no active exploits are known, the flaw could be leveraged to destabilize the kernel or escalate privileges if exploited.

A fix is available that adds bounds checking in ipv6_find_hdr() to ensure the offset does not exceed the packet length, rejecting malformed headers. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. No additional mitigations are indicated by the vendor advisory.