In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overhead() The seg6, ioam6… (CVE-2026-98570)

The vulnerability in the Linux kernel involves the dst_dev_overhead() function used in IPv6 networking code, specifically in seg6, ioam6, and rpl lightweight tunnels. These tunnels size their skb_cow_head() request based on the length of headers to be pushed plus dst_dev_overhead(), then rebuild the MAC header with skb_mac_header_rebuild(). The function dst_dev_overhead() previously reserved space assuming a 16-byte Ethernet MAC header, but when the MAC header is longer (e.g., ingress through a VLAN device with reorder_hdr off), the rebuild runs out of room. This causes skb_set_mac_header() to compute a negative offset, which is stored unchecked, leading to a memmove operation that writes approximately 64 KB past the skb->head buffer, resulting in memory corruption. The patch fixes this by returning the larger of the two header size values, ensuring sufficient headroom and preventing the overflow.

The vulnerability can cause out-of-bounds memory writes in the kernel networking stack when forwarding IPv6 traffic through certain VLAN devices. This memory corruption could potentially lead to kernel crashes or other undefined behavior. However, no known exploits in the wild have been reported. The impact is limited to scenarios involving seg6, ioam6, and rpl lightweight tunnels with specific VLAN configurations.

A fix has been implemented in the Linux kernel to address this vulnerability by adjusting dst_dev_overhead() to return the larger required MAC header size, preventing the out-of-bounds write. Users should apply the official kernel update containing this fix. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor or kernel maintainers for the specific fixed versions and apply updates accordingly.