Strix
73.2K

CVE-2026-98950

UnknownEPSS 0.18%

Last modified

CVE-2026-98950 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet. struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping. Found by sashiko while reviewing the commit above.

Metrics

EPSS Probability
0.18%

7.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9, < 46d21495f633e38d40857401504ee51c56ffed2a; >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9, < 6267f8304cbd9ec9f3f53bd227a733e07131492e; >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9, < 99c59062172620a0bac4ae8cf37c83bb78772cdd; >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9, < c44c02c930c6583b235a1937c69ff716c4bb4514; >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9, < 3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a; >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9, < cc18eb0e9941162c03f03f411ed7f6c339d91fa0; >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9, < 61b43a51a55929ec040bee3ea51af2121b956d05; >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9, < f202578efc738b883cfa04889eb97328914265a7
LinuxLinux4.20

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98950?
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet. struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping. Found by sashiko while reviewing the commit above.
How severe is CVE-2026-98950?
Severity scoring for CVE-2026-98950 is pending analysis. The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2026-98950?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98950?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST