PT-2026-114381 · Linux · Linux
CVE-2026-98402
·
Published
2026-10-14
·
Updated
2026-10-14
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: icmp: avoid invalid transport header access in icmp send tracepoint
syzbot reported a WARNING triggered by DEBUG NET WARN ON ONCE():
WARNING: at skb transport header include/linux/skbuff.h:3087 [inline]
WARNING: at udp hdr include/linux/udp.h:23 [inline]
WARNING: at do trace event raw event icmp send include/trace/events/icmp.h:30 [inline]
WARNING: at trace event raw event icmp send+0x48c/0x6ec include/trace/events/icmp.h:11
Call trace:
skb transport header include/linux/skbuff.h:3087 [inline]
udp hdr include/linux/udp.h:23 [inline]
do trace event raw event icmp send include/trace/events/icmp.h:30 [inline]
trace event raw event icmp send+0x48c/0x6ec include/trace/events/icmp.h:11
traceiter icmp send include/trace/events/icmp.h:11 [inline]
do trace icmp send include/trace/events/icmp.h:11 [inline]
trace icmp send+0x320/0x49c include/trace/events/icmp.h:11
icmp send+0xcfc/0x11d8 net/ipv4/icmp.c:1013
ipv4 send dest unreach net/ipv4/route.c:1280 [inline]
ipv4 link failure+0x57c/0x8dc net/ipv4/route.c:1287
dst link failure include/net/dst.h:438 [inline]
vti tunnel xmit+0xe40/0x17a4 net/ipv4/ip vti.c:307
TP fast assign() unconditionally calls udp hdr(skb) before checking
whether the packet is UDP. Furthermore, icmp send() can be invoked
from paths (e.g., link failures, ARP errors, forwarding, AF PACKET)
where skb->transport header was never initialized (~0U).
Under CONFIG DEBUG NET=y, calling skb transport header(skb) triggers
DEBUG NET WARN ON ONCE(!skb transport header was set(skb)).
Fix this by:
- Only parsing transport info when iph->protocol == IPPROTO UDP.
- Using skb header pointer() at skb network offset(skb) + (iph->ihl << 2) to safely fetch the UDP header without assuming transport header is set.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux