CVE-2026-98621

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: gue: reject invalid REMCSUM offsets

The REMCSUM option carries an absolute checksum start and checksum field

offset. gue_remcsum() passes them to skb_remcsum_process(), whose

partial path stores offset - start in the u16 skb->csum_offset variable.

If offset is less than start, this underflows.

A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM

driver which trusts the metadata, leading skb_copy_and_csum_dev() to write

two bytes about 64 KiB beyond the destination buffer.

Reject reversed tuples in validate_gue_flags(), after the existing length

validation, so all GUE parsers enforce the ordering in one place.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References