CVE-2026-98402
Description
In the Linux kernel, the following vulnerability has been resolved: net: icmp: avoid invalid transport header access in icmp_send tracepoint syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE(): WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline] WARNING: at udp_hdr include/linux/udp.h:23 [inline] WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skb_transport_header include/linux/skbuff.h:3087 [inline] udp_hdr include/linux/udp.h:23 [inline] do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 __traceiter_icmp_send include/trace/events/icmp.h:11 [inline] __do_trace_icmp_send include/trace/events/icmp.h:11 [inline] trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11 __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline] ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287 dst_link_failure include/net/dst.h:438 [inline] vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307 TP_fast_assign() unconditionally calls udp_hdr(skb) before checking whether the packet is UDP. Furthermore, __icmp_send() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AF_PACKET) where skb->transport_header was never initialized (~0U). Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)). Fix this by: 1. Only parsing transport info when iph->protocol == IPPROTO_UDP. 2. Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2) to safely fetch the UDP header without assuming transport_header is set.
How to fix
- Linux Linuxec6d4612d1c170e1cef1fe55526471da1e81e777, 99654b651c6d5fe865798a2adb859767905f9278, b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1, 04c0d35bac5122b533672a6775851dfae84e265e, 2b32f8c3560905582fb12ed68315a6e606367a6a, 7fcc2fe39fed1cb98a7374a113ff3800e8f9af80, 6.1.189, 6.6.158 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 524c341cb16a8d5318d2ffacf6fe160271a18743 ≤ v < ec6d4612d1c170e1cef1fe55526471da1e81e777, 21b28f97e621cba196fb32c576734d216a8a79c9 ≤ v < 99654b651c6d5fe865798a2adb859767905f9278, db3efdcf70c752e8a8deb16071d8e693c3ef8746 ≤ v < b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1, db3efdcf70c752e8a8deb16071d8e693c3ef8746 ≤ v < 04c0d35bac5122b533672a6775851dfae84e265e, db3efdcf70c752e8a8deb16071d8e693c3ef8746 ≤ v < 2b32f8c3560905582fb12ed68315a6e606367a6a, db3efdcf70c752e8a8deb16071d8e693c3ef8746 ≤ v < 7fcc2fe39fed1cb98a7374a113ff3800e8f9af80, 6.1.130 ≤ v < 6.1.189, 6.6.81 ≤ v < 6.6.158, 6.10 | ec6d4612d1c170e1cef1fe55526471da1e81e777, 99654b651c6d5fe865798a2adb859767905f9278, b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1, 04c0d35bac5122b533672a6775851dfae84e265e, 2b32f8c3560905582fb12ed68315a6e606367a6a, 7fcc2fe39fed1cb98a7374a113ff3800e8f9af80, 6.1.189, 6.6.158 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.