CVE-2026-98271

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: do not leave stale header offsets after pskb_carve()

pskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove

the first bytes of a packet and reallocate skb->head.

All the headers that were present before the operation are gone,

but both functions call skb_headers_offset_update(skb, 0), which

is a no-op : skb->mac_header, skb->network_header,

skb->transport_header and skb->csum_start keep their old values and

now describe bytes which are no longer there.

Both helpers size the new head from the old skb_end_offset(), so the

stale offsets still land inside the new allocation. They point past

skb_tail_pointer() though, to bytes that were never initialized.

pskb_carve_inside_nonlinear() is the worst case, because it leaves a

zombie skb with an empty linear part (skb->data ==

skb_tail_pointer(skb), skb_headlen(skb) == 0), while

skb_mac_header_was_set() is still true and skb->mac_header is way

ahe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References