{
  "cveId": "CVE-2026-98954",
  "url": "https://patchblox.com/security/cve/CVE-2026-98954",
  "summary": "CVE-2026-98954 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98954 (version 7.2.11-1), released October 24, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "net: always dissect GSO packets in __virtio_net_hdr_to_skb()",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: always dissect GSO packets in __virtio_net_hdr_to_skb()  Commit 9e8db5913264 (\u0022net: avoid false positives in untrusted gso validation\u0022) added a \u0027\u0026\u0026 skb-\u003Enetwork_header\u0027 check before flow-dissecting GSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM in __virtio_net_hdr_to_skb(), because some callers (such as tun_get_user(), tun_xdp_one(), virtnet_receive_done(), and raw_verify_header()) called virtio_net_hdr_*_to_skb() before initializing skb-\u003Enetwork_header and skb-\u003Edev.  Because __alloc_skb() and __build_skb_around() zero-initialize skb-\u003Enetwork_header to 0 (unlike mac_header and transport_header which are initialized to ~0U), those four callers always had skb-\u003Enetwork_header == 0 and bypassed flow dissection in __virtio_net_hdr_to_skb(). More generally, skb-\u003Enetwork_header is an offset from skb-\u003Ehead (where 0 is also a valid offset whenever skb_headroom(skb) is 0), not a boolean flag.  Whenever the \u0027if (gso_type \u0026\u0026 skb-\u003Enetwork_header)\u0027 branch was skipped, the fallback \u0027else if (gso_type)\u0027 only pulled nh_min_len \u002B thlen (40 bytes for TCPv4) without dissecting the packet, without validating ip_proto or n_proto, and without setting skb-\u003Etransport_header.  If the packet has a malformed network header, it is not rejected and a subsequent skb_probe_transport_header() also fails, leaving skb-\u003Etransport_header at ~0U (0xffff). Similarly, if an IPv4 packet carries IP options (ihl \u003E 5) or an IPv6 packet carries extension headers, pulling only nh_min_len \u002B thlen can leave the TCP header outside skb-\u003Ehead. In both cases, tcp_hdrlen(skb) in skb_gso_transport_seglen() reads out-of-bounds:    BUG: KASAN: slab-out-of-bounds in skb_gso_transport_seglen   Read of size 2 by task poc/133   skb_gso_transport_seglen (net/core/gso.c:155)   skb_gso_validate_mac_len (net/core/gso.c:270)   tbf_enqueue (net/sched/sch_tbf.c:260)   dev_qdisc_enqueue (net/core/dev.c:4227)   __dev_queue_xmit (net/core/dev.c:4884)  In addition, checking virtio_net_hdr_match_proto() only inside \u0027if (!skb-\u003Eprotocol)\u0027 before flow dissection both skipped validation when skb-\u003Eprotocol was pre-set by the caller and rejected VLAN-tagged frames whose outer L2 protocol is ETH_P_8021Q or ETH_P_8021AD.  Fix this by: 1. Initializing skb-\u003Edev and skb-\u003Enetwork_header (plus skb-\u003Eprotocol for    IFF_TUN) before virtio_net_hdr_*_to_skb() in tun_get_user(),    tun_xdp_one(), virtnet_receive_done(), and raw_verify_header(). In    tun_get_user(), drop the redundant skb_reset_mac_header(skb) in the    IFF_TUN case since __virtio_net_hdr_to_skb() unconditionally resets    mac_header. 2. Removing \u0027\u0026\u0026 skb-\u003Enetwork_header\u0027 and the unvalidated    \u0027else if (gso_type)\u0027 fallback in __virtio_net_hdr_to_skb() so all GSO    packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are flow-dissected, have    their transport header pulled into linear data, and have    skb-\u003Etransport_header set. 3. Moving the virtio_net_hdr_match_proto() check to after    skb_flow_dissect_flow_keys_basic(), validating keys.basic.n_proto    against hdr_gso_type.",
  "published": "2026-10-23T13:17:16Z",
  "severity": "Moderate",
  "cvss": 4.4,
  "epss": 0.00173,
  "epssPercentile": 0.06762,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98954",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-98954",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98954",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}