In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute… (CVE-2026-98621)

The vulnerability in the Linux kernel's GUE module relates to improper handling of the REMCSUM option's checksum start and offset fields. Specifically, gue_remcsum() passes these fields to skb_remcsum_process(), where an underflow occurs if the checksum offset is less than the start value, resulting in an incorrect skb->csum_offset. This can cause a forwarded packet with CHECKSUM_PARTIAL to reach a hardware checksum driver that trusts this metadata, leading skb_copy_and_csum_dev() to write two bytes approximately 64 KiB beyond the destination buffer, potentially causing memory corruption. The remediation involves rejecting reversed offset tuples in validate_gue_flags(), consolidating validation to prevent this underflow and subsequent buffer overflow.

The vulnerability can lead to a buffer overflow condition where two bytes are written beyond the allocated buffer boundary during packet processing. This memory corruption could potentially be exploited to cause system instability or other unintended behavior in the Linux kernel networking stack. No known exploits in the wild have been reported.

A fix has been implemented that rejects invalid REMCSUM offset tuples in the Linux kernel's GUE parser, preventing the underflow and subsequent buffer overflow. Users should apply the official kernel update containing this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.