CVE-2026-98621

In the Linux kernel, the following vulnerability has been resolved:

net: gue: reject invalid REMCSUM offsets

The REMCSUM option carries an absolute checksum start and checksum field offset. gue remcsum() passes them to skb remcsum process(), whose partial path stores offset - start in the u16 skb->csum offset variable. If offset is less than start, this underflows.

A forwarded packet can retain CHECKSUM PARTIAL and reach a NETIF F HW CSUM driver which trusts the metadata, leading skb copy and csum dev() to write two bytes about 64 KiB beyond the destination buffer.

Reject reversed tuples in validate gue flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.