CVE-2026-98402

In the Linux kernel, the following vulnerability has been resolved:

net: icmp: avoid invalid transport header access in icmp send tracepoint

syzbot reported a WARNING triggered by DEBUG NET WARN ON ONCE():

WARNING: at skb transport header include/linux/skbuff.h:3087 [inline] WARNING: at udp hdr include/linux/udp.h:23 [inline] WARNING: at do trace event raw event icmp send include/trace/events/icmp.h:30 [inline] WARNING: at trace event raw event icmp send+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skb transport header include/linux/skbuff.h:3087 [inline] udp hdr include/linux/udp.h:23 [inline] do trace event raw event icmp send include/trace/events/icmp.h:30 [inline] trace event raw event icmp send+0x48c/0x6ec include/trace/events/icmp.h:11 traceiter icmp send include/trace/events/icmp.h:11 [inline] do trace icmp send include/trace/events/icmp.h:11 [inline] trace icmp send+0x320/0x49c include/trace/events/icmp.h:11 icmp send+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4 send dest unreach net/ipv4/route.c:1280 [inline] ipv4 link failure+0x57c/0x8dc net/ipv4/route.c:1287 dst link failure include/net/dst.h:438 [inline] vti tunnel xmit+0xe40/0x17a4 net/ipv4/ip vti.c:307

TP fast assign() unconditionally calls udp hdr(skb) before checking whether the packet is UDP. Furthermore, icmp send() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AF PACKET) where skb->transport header was never initialized (~0U).

Under CONFIG DEBUG NET=y, calling skb transport header(skb) triggers DEBUG NET WARN ON ONCE(!skb transport header was set(skb)).

Fix this by: