UBUNTU-CVE-2026-98288: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit() stores the protocol header length returned by stmmactsoheadersize() in a u8. stmmactsovalidpacket() admits headers up to 1023 bytes, so a header longer than 255 bytes wraps modulo 256 (486 becomes 230, 256 becomes 0). A TCP over IPv6 socket carrying a few hundred bytes of sticky destination/hop-by-hop options makes skbtcpallheaders() exceed 255 while staying below the 1023-byte limit, so such an skb reaches stmmactsoxmit(). Widen protohdrlen to unsigned int, which is sufficient since the value is bounded by the hardware limit, and adjust the debug print specifier accordingly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Affected systems are Ubuntu installations using one of the listed Linux kernel packages and an STMMAC network device driver. Exploitation also depends on transmitting TCP over IPv6 traffic with sufficiently large sticky destination or hop-by-hop option headers.
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required, with no user interaction. The triggering traffic is a TCP-over-IPv6 socket whose protocol headers exceed 255 bytes but remain within the driver’s 1023-byte accepted limit.
What is the impact if the flaw is triggered?
The truncated header length can cause incorrect TSO processing in the STMMAC driver. The supplied severity vector identifies availability impact as high, while confidentiality and integrity impact are listed as none.
How can I tell whether a system may be affected?
Check whether the running Ubuntu kernel belongs to one of the listed packages and whether the system uses the STMMAC Ethernet driver. A potentially triggering workload uses TCP over IPv6 with sticky destination or hop-by-hop options that produce a total TCP header length above 255 bytes.