CVE-2026-98852Hinoki check available

Packet loss via missed IPv6 extension headers

Published Oct 18, 2026 · Updated Oct 18, 2026

Packet loss in Linux kernel tunnel checksum offload allows attackers to interrupt tunneled traffic via affected GSO packets. In net/core/dev.c, skb_gso_has_extension_hdr() skips outer IPv6 extension headers on encapsulated packets, causing skb_csum_hwoffload_help() to send unsegmented GSO packets to skb_checksum_help(), which warns and drops them. Exposure depends on tunnel traffic reaching the affected IPv6 checksum-offload path; the disclosure establishes packet drops, not a kernel crash, and does not establish attacker privileges.

CVSS severityUnavailable
Unscored
EPSS probability0.16%
Next 30 days · Oct 19, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkAvailable
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Get started

Summary

What happened

Packet loss in Linux kernel tunnel checksum offload allows attackers to interrupt tunneled traffic via affected GSO packets. In net/core/dev.c, skb_gso_has_extension_hdr() skips outer IPv6 extension headers on encapsulated packets, causing skb_csum_hwoffload_help() to send unsegmented GSO packets to skb_checksum_help(), which warns and drops them. Exposure depends on tunnel traffic reaching the affected IPv6 checksum-offload path; the disclosure establishes packet drops, not a kernel crash, and does not establish attacker privileges.

The record

CVE
CVE-2026-98852
Published
Oct 18, 2026
Updated
Oct 18, 2026
Vendor
The Linux Kernel Organization
Product
Linux
Classifications
Unavailable
Attack vector
Unavailable
Privileges
Unavailable

Timeline

How it unfolded

  1. Oct 18, 2026CVE publishedPublication date reported by the CVE source.
  2. Oct 18, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=2094a7cf91b71367b649f991aacc7b579f793d0b
  2. Affected versionversion=33670f780e0120c3dacda188c512bbffe0b6044c <44ba9dc568c878b699d05e7cf699572dc9df4b59
  3. Affected versionversion=6.1.168 <6.2
  4. Affected versionversion=6.12.81 <6.12.113
  5. Affected versionversion=6.18.22 <6.18.56
  6. Affected versionversion=6.19.12 <6.20
  7. Affected versionversion=6.6.134 <6.7
  8. Affected versionversion=7.0
  9. Affected versionversion=732fdeb2987c94b439d51f5cb9addddc2fc48c42
  10. Affected versionversion=a98b78116a27e2a57b696b569b2cb431c95cf9b6 <aa480f05aed7a9eee87d4a6fc90647fe9679c670
  11. Affected versionversion=c4336a07eb6b2526dc2b62928b5104b41a7f81f5 <5f0764cb1c81a9712bce605d38efe6d844a70b29
  12. Affected versionversion=c4336a07eb6b2526dc2b62928b5104b41a7f81f5 <cabacdf98e09eb74599c4d97d7bd7fd659598fb7
  13. Affected versionversion=ed71cf465c75f5688b07a35d373cd1d6b589c8ea

What conditions does exploitation require?

Attack vectorUnavailable in this record.
Required privilegesUnavailable in this record.

What is affected?

The Linux Kernel Organization · Linuxversion=2094a7cf91b71367b649f991aacc7b579f793d0b; version=33670f780e0120c3dacda188c512bbffe0b6044c <44ba9dc568c878b699d05e7cf699572dc9df4b59; version=6.1.168 <6.2; version=6.12.81 <6.12.113; version=6.18.22 <6.18.56; version=6.19.12 <6.20; version=6.6.134 <6.7; version=7.0; version=732fdeb2987c94b439d51f5cb9addddc2fc48c42; version=a98b78116a27e2a57b696b569b2cb431c95cf9b6 <aa480f05aed7a9eee87d4a6fc90647fe9679c670; version=c4336a07eb6b2526dc2b62928b5104b41a7f81f5 <5f0764cb1c81a9712bce605d38efe6d844a70b29; version=c4336a07eb6b2526dc2b62928b5104b41a7f81f5 <cabacdf98e09eb74599c4d97d7bd7fd659598fb7; version=ed71cf465c75f5688b07a35d373cd1d6b589c8ea

Published CVSS scores

No CVSS assessment is available in this record.

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Activity data is delayed. The latest report is Sep 28, 2026.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 22, 2026Sep 28, 2026
Latest reporting daySep 28, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
VectorUnavailable
PrivilegesUnavailable
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

No sourced classifications are available.

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Get started to see how Hinoki identifies affected software and validates exploitability in your environment.

Get started