InfoSec Signals™
Sign InStart Free
Back to CVE records
Not yet scoredPublished Oct 18, 2026

CVE-2026-98621net: gue: reject invalid REMCSUM offsets

Updated under an hour ago ()

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows. A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer. Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.

CVSS
Not yet scored
Weakness (CWE)
Not given
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
Linux
NVD analysis
Received
Record last updated
Oct 19, 2026
First seen by InfoSec Signals
Oct 18, 2026

Affected products

Affected products
Linux Linux
linux:linux (from the name)
from fe881ef11cf0220f118816181930494d484c4883 before 4b9bc21b2396c396d88dd909caaf73d5be6ff593; from fe881ef11cf0220f118816181930494d484c4883 before 43efb1f997e976f386aa89716f55870cd2cff9ad; from fe881ef11cf0220f118816181930494d484c4883 before 1eeec0c51fd5598da44080ed96bbd9880021c28b; from fe881ef11cf0220f118816181930494d484c4883 before 1d664be4ca49d1696e85239236f4988dfc4653c3; from fe881ef11cf0220f118816181930494d484c4883 before 97f907203321eee2cc9132d5c9eb47698fb41d35; from fe881ef11cf0220f118816181930494d484c4883 before 40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f; from fe881ef11cf0220f118816181930494d484c4883 before c20f755338ca234e523dfc943719f194dfc1f903; from fe881ef11cf0220f118816181930494d484c4883 before 2566866fc30965d915d0b52b5c3323b362619f0e
CNA record

References

References

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.