CVE-2026-98950

In the Linux kernel, the following vulnerability has been resolved:

flow dissector: avoid u16 truncation of hlen in bpf flow dissect()

bpf flow dissect() sanitizes the offsets returned by the BPF program with clamp t(u16, ..., hlen).

If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values.

This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because skb flow dissect() returns early when a BPF flow dissector handles the packet.

struct bpf flow keys stores nhoff and thoff as u16, so cap hlen to U16 MAX before clamping.

Found by sashiko while reviewing the commit above.