{"api_version":"1","generated_at":"2026-10-21T00:45:45+00:00","cve":"CVE-2026-98570","urls":{"html":"https://cve.report/CVE-2026-98570","api":"https://cve.report/api/cve/CVE-2026-98570.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98570","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98570"},"summary":{"title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: keep room for the mac header in dst_dev_overhead()\n\nThe seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as\nthe length they are about to push plus dst_dev_overhead(), then push the\nnew headers and rebuild the mac header below them with\nskb_mac_header_rebuild().  That rebuild needs skb->mac_len of headroom,\nbut dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,\n16 bytes for plain Ethernet.\n\nWhere the mac header is longer than that, as it is on ingress through a\nVLAN device with reorder_hdr off, the rebuild runs out of room:\nskb_set_mac_header(skb, -skb->mac_len) computes a negative offset,\nstores it unchecked in the u16 skb->mac_header, and the memmove that\nfollows writes skb->mac_len bytes about 64 KB past skb->head.\nForwarding plain ping6 traffic through such a device reproduces it on\nall five seg6 encapsulation modes and on the rpl and ioam6 inline paths;\nskb->mac_header comes back as 65534 on a 704-byte head.\n\nReturn the larger of the two.  The helper already returns skb->mac_len\nwhen it has no dst, so this only makes the other branch agree, and it\ncovers every caller rather than each call site in turn.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:17:09","updated_at":"2026-10-19 10:19:15"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e","name":"https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/36c07127924f11fc5741a780abcaaf808fe9ef13","name":"https://git.kernel.org/stable/c/36c07127924f11fc5741a780abcaaf808fe9ef13","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98570","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98570","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dce525185bc92864e5a318040285ee070563fe34 36c07127924f11fc5741a780abcaaf808fe9ef13 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected dce525185bc92864e5a318040285ee070563fe34 87cd6b717e4069dca34e0866e57eaeb44d3b173e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 8471e228448a818e4c27cab4b681b2e758e46cf5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c432cd18a07b623651ed15ea167bd303467004cc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 634710a372ba65bee667c2f6e58a97658c639eab git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c447c5a9c47bb4858ab12bf90879fe595d2b7f46 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ab9de9c48316d2622d3bf353916b99971570e2c9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2fcc9f3798ef82399564d247458e69abd10e683b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 371d8dc298b4f59e99b4564ac5d906fce0932c69 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b26f015dfb07b6be12d005a0ed0c5c43b7bedbf3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c0b11dc50590e10590b39dcda79835cd32f49d00 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4c12c3c8abd8b888945d31e7bdbb0d8b73032fc5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 25d8e065c7972dc98fd7a4cac322d5367eaede88 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4a855c5aec41bf84922224ab7a74e088776e3ac4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a9f0407414e16176fdbbbd298c9e18d6dfdf96bc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.16 6.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.13.4 6.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.179 5.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.1.130 6.2 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.6.81 6.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.235 5.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/dst.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"36c07127924f11fc5741a780abcaaf808fe9ef13","status":"affected","version":"dce525185bc92864e5a318040285ee070563fe34","versionType":"git"},{"lessThan":"87cd6b717e4069dca34e0866e57eaeb44d3b173e","status":"affected","version":"dce525185bc92864e5a318040285ee070563fe34","versionType":"git"},{"status":"affected","version":"8471e228448a818e4c27cab4b681b2e758e46cf5","versionType":"git"},{"status":"affected","version":"c432cd18a07b623651ed15ea167bd303467004cc","versionType":"git"},{"status":"affected","version":"634710a372ba65bee667c2f6e58a97658c639eab","versionType":"git"},{"status":"affected","version":"c447c5a9c47bb4858ab12bf90879fe595d2b7f46","versionType":"git"},{"status":"affected","version":"ab9de9c48316d2622d3bf353916b99971570e2c9","versionType":"git"},{"status":"affected","version":"2fcc9f3798ef82399564d247458e69abd10e683b","versionType":"git"},{"status":"affected","version":"371d8dc298b4f59e99b4564ac5d906fce0932c69","versionType":"git"},{"status":"affected","version":"b26f015dfb07b6be12d005a0ed0c5c43b7bedbf3","versionType":"git"},{"status":"affected","version":"c0b11dc50590e10590b39dcda79835cd32f49d00","versionType":"git"},{"status":"affected","version":"4c12c3c8abd8b888945d31e7bdbb0d8b73032fc5","versionType":"git"},{"status":"affected","version":"25d8e065c7972dc98fd7a4cac322d5367eaede88","versionType":"git"},{"status":"affected","version":"4a855c5aec41bf84922224ab7a74e088776e3ac4","versionType":"git"},{"status":"affected","version":"a9f0407414e16176fdbbbd298c9e18d6dfdf96bc","versionType":"git"},{"lessThan":"6.13","status":"affected","version":"6.12.16","versionType":"semver"},{"lessThan":"6.14","status":"affected","version":"6.13.4","versionType":"semver"},{"lessThan":"5.16","status":"affected","version":"5.15.179","versionType":"semver"},{"lessThan":"6.2","status":"affected","version":"6.1.130","versionType":"semver"},{"lessThan":"6.7","status":"affected","version":"6.6.81","versionType":"semver"},{"lessThan":"5.11","status":"affected","version":"5.10.235","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/dst.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.179","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.130","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.81","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.235","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.179","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.130","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.81","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: keep room for the mac header in dst_dev_overhead()\n\nThe seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as\nthe length they are about to push plus dst_dev_overhead(), then push the\nnew headers and rebuild the mac header below them with\nskb_mac_header_rebuild().  That rebuild needs skb->mac_len of headroom,\nbut dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,\n16 bytes for plain Ethernet.\n\nWhere the mac header is longer than that, as it is on ingress through a\nVLAN device with reorder_hdr off, the rebuild runs out of room:\nskb_set_mac_header(skb, -skb->mac_len) computes a negative offset,\nstores it unchecked in the u16 skb->mac_header, and the memmove that\nfollows writes skb->mac_len bytes about 64 KB past skb->head.\nForwarding plain ping6 traffic through such a device reproduces it on\nall five seg6 encapsulation modes and on the rpl and ioam6 inline paths;\nskb->mac_header comes back as 65534 on a 704-byte head.\n\nReturn the larger of the two.  The helper already returns skb->mac_len\nwhen it has no dst, so this only makes the other branch agree, and it\ncovers every caller rather than each call site in turn."}],"providerMetadata":{"dateUpdated":"2026-10-19T09:21:55.765Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/36c07127924f11fc5741a780abcaaf808fe9ef13"},{"url":"https://git.kernel.org/stable/c/87cd6b717e4069dca34e0866e57eaeb44d3b173e"}],"title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98570","datePublished":"2026-10-18T15:18:36.308Z","dateReserved":"2026-09-25T10:25:14.357Z","dateUpdated":"2026-10-19T09:21:55.765Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:17:09","lastModifiedDate":"2026-10-19 10:19:15","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98570","Ordinal":"1","Title":"net: ipv6: keep room for the mac header in dst_dev_overhead()","CVE":"CVE-2026-98570","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98570","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: keep room for the mac header in dst_dev_overhead()\n\nThe seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as\nthe length they are about to push plus dst_dev_overhead(), then push the\nnew headers and rebuild the mac header below them with\nskb_mac_header_rebuild().  That rebuild needs skb->mac_len of headroom,\nbut dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,\n16 bytes for plain Ethernet.\n\nWhere the mac header is longer than that, as it is on ingress through a\nVLAN device with reorder_hdr off, the rebuild runs out of room:\nskb_set_mac_header(skb, -skb->mac_len) computes a negative offset,\nstores it unchecked in the u16 skb->mac_header, and the memmove that\nfollows writes skb->mac_len bytes about 64 KB past skb->head.\nForwarding plain ping6 traffic through such a device reproduces it on\nall five seg6 encapsulation modes and on the rpl and ioam6 inline paths;\nskb->mac_header comes back as 65534 on a 704-byte head.\n\nReturn the larger of the two.  The helper already returns skb->mac_len\nwhen it has no dst, so this only makes the other branch agree, and it\ncovers every caller rather than each call site in turn.","Type":"Description","Title":"net: ipv6: keep room for the mac header in dst_dev_overhead()"}]}}}