CVE-2026-98288: net: stmmac: fix TSO header length truncation
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix TSO header length truncation
stmmactsoxmit() stores the protocol header length returned by stmmactsoheadersize() in a u8. stmmactsovalidpacket() admits headers up to 1023 bytes, so a header longer than 255 bytes wraps modulo 256 (486 becomes 230, 256 becomes 0).
A TCP over IPv6 socket carrying a few hundred bytes of sticky destination/hop-by-hop options makes skbtcpallheaders() exceed 255 while staying below the 1023-byte limit, so such an skb reaches stmmactsoxmit().
Widen protohdrlen to unsigned int, which is sufficient since the value is bounded by the hardware limit, and adjust the debug print specifier accordingly.
Affected Software
Event History
Frequently Asked Questions
What traffic conditions are needed to reach the vulnerable transmit path?
The condition requires a TCP-over-IPv6 packet with enough sticky destination or hop-by-hop options to make the combined TCP/IP header exceed 255 bytes while remaining within the 1023-byte header limit accepted by validation. Such a packet can then reach the TSO transmit routine with a truncated header-length value.
Which systems are most relevant for triage?
The issue is in the Linux kernel stmmac network driver’s TCP segmentation offload transmit handling. Systems using that driver and processing the described oversized IPv6/TCP headers are the relevant population.
What is the underlying failure mode?
The protocol header length was stored in an 8-bit value even though validation permits values up to 1023 bytes. Lengths above 255 therefore wrap modulo 256, potentially causing the transmit routine to use an incorrect header length.