CVE-2026-98950
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet. struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping. Found by sashiko while reviewing the commit above.
Affected versions
Linux kernel versions
4.20
and later are affected. Fixed in
6.6.160,
6.12.113,
6.18.57,
7.2.11,
7.3
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-98950?
CVE-2026-98950 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.20 onward and has been patched in 6.6.160, 6.12.113, 6.18.57 and others. CVE-2026-98950 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98950?
Yes. CVE-2026-98950 has been patched. Fixed versions include 6.6.160, 6.12.113, 6.18.57 and others. If you are running Linux kernel 4.20 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98950 actively exploited?
No. CVE-2026-98950 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.