In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()… (CVE-2026-98573)

The vulnerability in the Linux kernel's net subsystem concerns skb_checksum_setup_ipv6() where skb_maybe_pull_tail() subtracts skb_headlen(skb) from an unsigned max argument and passes the result as a signed integer to __pskb_pull_tail() without ensuring max is at least skb_headlen(skb). When parsing IPv6 extension headers with an skb linear area larger than MAX_IPV6_HDR_LEN, this subtraction wraps around, producing a negative delta. This negative delta is then passed to skb_copy_bits(), resulting in a very large copy length. The patch corrects this by passing the requested length itself as the pull bound at the extension-header call sites, preventing the delta from going negative.

This vulnerability could cause skb_copy_bits() to perform an excessively large copy operation due to an underflow in pull-bound calculation when processing IPv6 extension headers. While the exact impact is not detailed, such behavior could potentially lead to memory corruption or kernel instability. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by correcting the pull-bound calculation in skb_checksum_setup_ipv6(). Users should apply the official kernel updates that include this patch. Since no vendor advisory or patch links are provided, verify with the Linux kernel maintainers or distribution vendors for the appropriate updated kernel versions.