CVE-2026-98573: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: fix pull-bound underflow in skbchecksumsetupipv6()
skbmaybepulltail() subtracts skbheadlen(skb) from the unsigned max argument and passes the result to pskbpulltail() as a signed int. The function does not ensure that max is at least skbheadlen(skb).
This can happen while parsing IPv6 extension headers when an skb already has a linear area larger than MAXIPV6HDRLEN. Once the parser needs data beyond the linear area, max - skbheadlen(skb) wraps and is converted to a negative delta. pskbpulltail() then passes that negative length to skbcopybits(), where it can become a very large copy length.
Pass the requested length itself as the pull bound at the three extension-header call sites, so the delta can no longer go negative.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In skb_checksum_setup_ipv6(), update the three IPv6 extension-header call sites to pass the requested length itself as the pull bound, preventing the delta from becoming negative before calling __pskb_pull_tail().