CVE-2026-98401: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-c6hw-23wq-xx46
Share
Published
Advisory Summary

CVE-2026-98401 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98401 at a Glance

CVE Identifier CVE-2026-98401
GHSA Identifier GHSA-c6hw-23wq-xx46
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98401

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98401, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale transport_header offset after tunnel decapsulation. BUG: unable to handle page fault for address: ffffed102091a42e Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__asan_load2 <IRQ> qdisc_pkt_len_segs_init (net/core/dev.c:4145) __dev_queue_xmit (net/core/dev.c:4787) br_dev_queue_push_xmit (net/bridge/br_forward.c:53) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:315) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6099) __netif_receive_skb_list_core (net/core/dev.c:6287) netif_receive_skb_list_internal (net/core/dev.c:6445) napi_complete_done (net/core/dev.c:6813) gro_cell_poll (net/core/gro_cells.c:74) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7798 net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) do_softirq (kernel/softirq.c:523 kernel/softirq.c:510 ) __local_bh_enable_ip (kernel/softirq.c:450) tun_get_user (drivers/net/tun.c:1986 (discriminator 1)) tun_chr_write_iter (drivers/net/tun.c:2032) The issue is completely latent until qdisc read transport header in commit 7fb4c1967011 ("net: pull headers in qdisc_pkt_len_segs_init()"). The crash requires four conditions to line up: 1. The incoming packet is encapsulated and carries GSO metadata. The outer transport header offset is stored in skb->transport_header while the packet is still in the outer tunnel context. 2. The tunnel receiver strips the outer headers. skb->data is advanced to the inner frame, but skb->transport_header is left pointing to the now-removed outer L4 header, so it becomes a negative offset relative to the new data. 3. The inner frame is not delivered to the local IP stack. Instead, it is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and the transport header is not reset to the inner L4 offset. 4. The forwarding path calls __dev_queue_xmit(), which enters qdisc_pkt_len_segs_init(). That function computes the GSO header length from skb_transport_offset(skb). Because the offset is negative, the unsigned cast overflows and pskb_may_pull(skb, hdr_len + sizeof(struct tcphdr)) reads past the end of the skb, triggering a KASAN fault or page fault. The issue specifically requires GSO packets (shinfo->gso_size != 0), which are processed/aggregated through gro_cells. Fix this by clearing transport_header to the ~0U sentinel in gro_cell for all tunnnel driver. GTP does not support GRO/GSO, drop the evil GSO packets in GTP directly.

References

NVD — CVE-2026-98401 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98401
git.kernel.org/stable/c/28a57fb2c5... WEB
https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034
git.kernel.org/stable/c/3340b8565b... WEB
https://git.kernel.org/stable/c/3340b8565b85631cfeb0df049e8b46e3ef8bd7bd
git.kernel.org/stable/c/8c3d4dfcec... WEB
https://git.kernel.org/stable/c/8c3d4dfcecf7670c1d752f1ae74b21b2af5feac1
git.kernel.org/stable/c/e4a5b01e59... WEB
https://git.kernel.org/stable/c/e4a5b01e59f7102169762b8f566c8e052d05c0ff

Frequently Asked Questions

What is CVE-2026-98401?
CVE-2026-98401 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98401?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98401?
CVE-2026-98401 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98401?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-c6hw-23wq-xx46",
  "modified" : "2026-10-14T15:32:19Z",
  "published" : "2026-10-14T15:32:19Z",
  "aliases" : [ "CVE-2026-98401" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: iptunnel: fix stale transport header during tunnel decapsulation\n\nSyzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale\ntransport_header offset after tunnel decapsulation.\n\nBUG: unable to handle page fault for address: ffffed102091a42e\nOops: Oops: 0000 [#1] SMP KASAN NOPTI\nCPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:__asan_load2\n<IRQ>\nqdisc_pkt_len_segs_init (net/core/dev.c:4145)\n__dev_queue_xmit (net/core/dev.c:4787)\nbr_dev_queue_push_xmit (net/bridge/br_forward.c:53)\nbr_handle_frame_finish (net/bridge/br_input.c:229)\nbr_handle_frame (net/bridge/br_input.c:315)\n__netif_receive_skb_core.constprop.0 (net/core/dev.c:6099)\n__netif_receive_skb_list_core (net/core/dev.c:6287)\nnetif_receive_skb_list_internal (net/core/dev.c:6445)\nnapi_complete_done (net/core/dev.c:6813)\ngro_cell_poll (net/core/gro_cells.c:74)\n__napi_poll (net/core/dev.c:7735)\nnet_rx_action (net/core/dev.c:7798 net/core/dev.c:7955)\nhandle_softirqs (kernel/softirq.c:622)\ndo_softirq (kernel/softirq.c:523  kernel/softirq.c:510 )\n__local_bh_enable_ip (kernel/softirq.c:450)\ntun_get_user (drivers/net/tun.c:1986 (discriminator 1))\ntun_chr_write_iter (drivers/net/tun.c:2032)\n\nThe issue is completely latent until qdisc read transport header in\ncommit 7fb4c1967011 (\"net: pull headers in qdisc_pkt_len_segs_init()\").\nThe crash requires four conditions to line up:\n\n1. The incoming packet is encapsulated and carries GSO metadata. The outer\n   transport header offset is stored in skb->transport_header while the\n   packet is still in the outer tunnel context.\n2. The tunnel receiver strips the outer headers. skb->data is advanced to\n   the inner frame, but skb->transport_header is left pointing to the\n   now-removed outer L4 header, so it becomes a negative offset relative to\n   the new data.\n3. The inner frame is not delivered to the local IP stack. Instead, it\n   is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and\n   the transport header is not reset to the inner L4 offset.\n4. The forwarding path calls __dev_queue_xmit(), which enters\n   qdisc_pkt_len_segs_init(). That function computes the GSO header length\n   from skb_transport_offset(skb). Because the offset is negative, the\n   unsigned cast overflows and pskb_may_pull(skb, hdr_len +\n   sizeof(struct tcphdr)) reads past the end of the skb, triggering a\n   KASAN fault or page fault.\n\nThe issue specifically requires GSO packets (shinfo->gso_size != 0), which\nare processed/aggregated through gro_cells. Fix this by clearing\ntransport_header to the ~0U sentinel in gro_cell for all tunnnel driver.\nGTP does not support GRO/GSO, drop the evil GSO packets in GTP directly.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98401"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/28a57fb2c5df4deb42a06e52fd36c14b37aa0034"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3340b8565b85631cfeb0df049e8b46e3ef8bd7bd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8c3d4dfcecf7670c1d752f1ae74b21b2af5feac1"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e4a5b01e59f7102169762b8f566c8e052d05c0ff"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-14T14:17:51Z"
  }
}