CVE-2026-98417: net: xfrm: reject unrepresentable espintcp transport headers
In the Linux kernel, the following vulnerability has been resolved:
net: xfrm: reject unrepresentable espintcp transport headers
ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates that offset and triggers the skb warning path.
Use the careful transport-header helper and drop the skb through the existing XFRM error path when the offset cannot be represented.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this condition?
The affected path is Linux kernel XFRM processing of ESP-in-TCP packets, specifically after the stream parser trims the TCP envelope. The provided data does not identify affected kernel versions or configuration defaults.
What occurs when the transport-header offset cannot be represented?
Before the resolution, resetting the plain transport header truncates the offset and triggers the skb warning path. The resolved behavior uses a checked transport-header helper and drops the skb through the existing XFRM error path.