CVE-2026-98372

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()

iptfs_skb_reset_frag_walk() advances to the fragment containing @offset

with an unbounded loop:

while (offset >= walk->past + walk->frags[walk->fragi].len)

walk->past += walk->frags[walk->fragi++].len;

walk->fragi is advanced and walk->frags[walk->fragi] is dereferenced

without ever checking fragi against walk->nr_frags. When the requested

offset is at or beyond the total length spanned by the walk's fragments,

fragi runs past nr_frags and off the end of the fixed-size on-stack

frags[MAX_SKB_FRAGS + 1] array, reading out-of-bounds stack memory.

The two callers behave differently: iptfs_skb_add_frags() already guards

against this with

if (!walk->nr_frags ||

offset >= walk->total + walk->initial_offset)

return len;

but iptfs_skb_can_add_frags() has no such guard and calls

iptfs_skb_reset_frag_walk() unconditionally, so it performs the

out-of

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References