CVE-2026-98371

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: fix runt reassembly panic from short inner tot_len

When the start of an inner packet is split across two outer packets

such that fewer than 4 bytes land at the end of the first one,

__input_process_payload() saves those bytes as a runt and skips the

iplen/iphlen validation performed for in-place packets. When the

continuation packet arrives, iptfs_reassem_cont() only requires the

declared inner length to be >= sizeof(ra_runt) (6) before allocating

the reassembly skb with that attacker-controlled length.

However, __iptfs_iphlen() always returns the fixed minimum IP header

size (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in

[6, 19] the header-completion copy writes past the declared packet

length, and the subsequent "ipremain -= copylen" underflows to ~4GB,

leaving the payload copy length bounded only by blkoff (up to 64KB).

At runtime the skb_put() tailroom check turns this into

skb_over_pan

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References