Answer in brief
CVE-2026-98570 records a Unknown severity vulnerability in net: ipv6: keep room for the mac header in dst_dev_overhead(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=dce525185bc92864e5a318040285ee070563fe34 <36c07127924f11fc5741a780abcaaf808fe9ef13 || >=dce525185bc92864e5a318040285ee070563fe34 <87cd6b717e4069dca34e0866e57eaeb44d3b173e || 8471e228448a818e4c27cab4b681b2e758e46cf5 || c432cd18a07b623651ed15ea167bd303467004cc || 634710a372ba65bee667c2f6e58a97658c639eab || c447c5a9c47bb4858ab12bf90879fe595d2b7f46 || ab9de9c48316d2622d3bf353916b99971570e2c9 || 2fcc9f3798ef82399564d247458e69abd10e683b || 371d8dc298b4f59e99b4564ac5d906fce0932c69 || b26f015dfb07b6be12d005a0ed0c5c43b7bedbf3 || c0b11dc50590e10590b39dcda79835cd32f49d00 || 4c12c3c8abd8b888945d31e7bdbb0d8b73032fc5 || 25d8e065c7972dc98fd7a4cac322d5367eaede88 || 4a855c5aec41bf84922224ab7a74e088776e3ac4 || a9f0407414e16176fdbbbd298c9e18d6dfdf96bc || >=6.12.16 <6.13 || >=6.13.4 <6.14 || >=5.15.179 <5.16 || >=6.1.130 <6.2 || >=6.6.81 <6.7 || >=5.10.235 <5.11 | 36c07127924f11fc5741a780abcaaf808fe9ef13, 87cd6b717e4069dca34e0866e57eaeb44d3b173e, 6.13, 6.14, 5.16, 6.2, 6.7, 5.11 |
| Linux/Linuxgeneric | 6.14 | Not reported |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overhead() The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as the length they are about to push plus dst_dev_overhead(), then push the new headers and rebuild the mac header below them with skb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom, but dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac header is longer than that, as it is on ingress through a VLAN device with reorder_hdr off, the rebuild runs out of room: skb_set_mac_header(skb, -skb->mac_len) computes a negative offset, stores it unchecked in the u16 skb->mac_header, and the memmove that follows writes skb->mac_len bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->mac_header comes back as 65534 on a 704-byte head. Return the larger of the two. The helper already returns skb->mac_len when it has no dst, so this only makes the other branch agree, and it covers every caller rather than each call site in turn.
Quoted source text, attributed separately from HOL analysis.