CVE-2026-98401

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: iptunnel: fix stale transport header during tunnel decapsulation

Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale

transport_header offset after tunnel decapsulation.

BUG: unable to handle page fault for address: ffffed102091a42e

Oops: Oops: 0000 [#1] SMP KASAN NOPTI

CPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

RIP: 0010:__asan_load2

<IRQ>

qdisc_pkt_len_segs_init (net/core/dev.c:4145)

__dev_queue_xmit (net/core/dev.c:4787)

br_dev_queue_push_xmit (net/bridge/br_forward.c:53)

br_handle_frame_finish (net/bridge/br_input.c:229)

br_handle_frame (net/bridge/br_input.c:315)

__netif_receive_skb_core.constprop.0 (net/core/dev.c:6099)

__netif_receive_skb_list_core (net/core/dev.c:6287)

netif_receive_skb_list_internal (net/core/dev.c:6445)

napi_complet

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References