CVE-2026-98402: net: icmp: avoid invalid transport header access in icmp_send tracepoint
In the Linux kernel, the following vulnerability has been resolved:
net: icmp: avoid invalid transport header access in icmpsend tracepoint
syzbot reported a WARNING triggered by DEBUGNETWARNONONCE():
WARNING: at skbtransportheader include/linux/skbuff.h:3087 [inline] WARNING: at udphdr include/linux/udp.h:23 [inline] WARNING: at dotraceeventraweventicmpsend include/trace/events/icmp.h:30 [inline] WARNING: at traceeventraweventicmpsend+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skbtransportheader include/linux/skbuff.h:3087 [inline] udphdr include/linux/udp.h:23 [inline] dotraceeventraweventicmpsend include/trace/events/icmp.h:30 [inline] traceeventraweventicmpsend+0x48c/0x6ec include/trace/events/icmp.h:11 traceitericmpsend include/trace/events/icmp.h:11 [inline] dotraceicmpsend include/trace/events/icmp.h:11 [inline] traceicmpsend+0x320/0x49c include/trace/events/icmp.h:11 icmpsend+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4senddestunreach net/ipv4/route.c:1280 [inline] ipv4linkfailure+0x57c/0x8dc net/ipv4/route.c:1287 dstlinkfailure include/net/dst.h:438 [inline] vtitunnelxmit+0xe40/0x17a4 net/ipv4/ipvti.c:307
TPfastassign() unconditionally calls udphdr(skb) before checking whether the packet is UDP. Furthermore, icmpsend() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AFPACKET) where skb->transportheader was never initialized (~0U).
Under CONFIGDEBUGNET=y, calling skbtransportheader(skb) triggers DEBUGNETWARNONONCE(!skbtransportheaderwasset(skb)).
Fix this by: 1. Only parsing transport info when iph->protocol == IPPROTOUDP. 2. Using skbheaderpointer() at skbnetworkoffset(skb) + (iph->ihl << 2) to safely fetch the UDP header without assuming transportheader is set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the ICMP send tracepoint to parse transport information only when iph->protocol == IPPROTO_UDP, and use skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2) to safely fetch the UDP header without assuming skb->transport_header is initialized.
Event History
Frequently Asked Questions
What runtime evidence may indicate that this issue has been triggered?
The reported symptom is a DEBUG_NET_WARN_ON_ONCE() warning involving skb_transport_header and udp_hdr during the icmp_send tracepoint, with a call trace reaching ipv4_link_failure and vti_tunnel_xmit.
Does the available information identify affected kernel versions or required configuration settings?
No. The provided data identifies the Linux kernel and lists stable-tree fix references, but does not specify affected versions, fixed versions, or configuration prerequisites.