CVE-2026-98532

waiting for further signals

GHSA-75wf-hf48-gmfv ↗EUVD-2026-103577 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Linux 3.8

fixed in ca96b38730e31357ef4a9d76af1336958ac670d7, 531255de8971c06d5d5986f85fdc2525d707ba71, 543354c6efb27eae3372a3a9674aeaa2a86e2b2c, dc92cb972e86790b8078337ec41015b748b8f8e5, 1c70275ca87e769e1a52abc644d61372d8c016cb, 1d42828565889632068fbc2983c34d57c66af4e0, 4254d5878c320c19961dd0b8e1d0aca4800d8b7d, ee319bd3a0e976af5087cbe59ebc50a66f31d202

ETK-2026-2397, permanent identifier

1h 00msince last run

10mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+87h01m

+2h

+4h

+6h

+8h

+10h

description

Affected Linux kernels can derive an invalid transport-header position when processing malformed IPv6 extension headers, leading subsequent processing to access memory beyond the packet buffer. An attacker must be able to cause a malformed IPv6 packet to reach an affected kernel parsing path; the evidence does not establish universal network reachability or required privileges.

mitigation

Update to a kernel release containing the applicable fix commit: ca96b38730e31357ef4a9d76af1336958ac670d7, 531255de8971c06d5d5986f85fdc2525d707ba71, 543354c6efb27eae3372a3a9674aeaa2a86e2b2c, dc92cb972e86790b8078337ec41015b748b8f8e5, 1c70275ca87e769e1a52abc644d61372d8c016cb, 1d42828565889632068fbc2983c34d57c66af4e0, 4254d5878c320c19961dd0b8e1d0aca4800d8b7d, or ee319bd3a0e976af5087cbe59ebc50a66f31d202. Until updated, limit untrusted malformed IPv6 traffic from reaching affected systems where feasible.

check

exploit

automation

–

auth required

–

EPSS

–

agent run time

10m

cve.org record, t = 0

2026-10-18 15:17Z

Δ to public poc

–

Δ to kev

–

outcome

No artifact: no remotely reachable path found.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-18 15:17Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-98532

this entry in the feed

GET /api/v1/feed/CVE-2026-98532

{
  "etk_id": "ETK-2026-2397",
  "cve_id": "CVE-2026-98532",
  "display_id": "CVE-2026-98532",
  "ghsa_id": "GHSA-75wf-hf48-gmfv",
  "euvd_id": "EUVD-2026-103577",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Out-of-bounds IPv6 extension-header parsing in the Linux kernel",
  "summary": "Affected Linux kernels can derive an invalid transport-header position when processing malformed IPv6 extension headers, leading subsequent processing to access memory beyond the packet buffer. An attacker must be able to cause a malformed IPv6 packet to reach an affected kernel parsing path; the evidence does not establish universal network reachability or required privileges.",
  "mitigation": "Update to a kernel release containing the applicable fix commit: ca96b38730e31357ef4a9d76af1336958ac670d7, 531255de8971c06d5d5986f85fdc2525d707ba71, 543354c6efb27eae3372a3a9674aeaa2a86e2b2c, dc92cb972e86790b8078337ec41015b748b8f8e5, 1c70275ca87e769e1a52abc644d61372d8c016cb, 1d42828565889632068fbc2983c34d57c66af4e0, 4254d5878c320c19961dd0b8e1d0aca4800d8b7d, or ee319bd3a0e976af5087cbe59ebc50a66f31d202. Until updated, limit untrusted malformed IPv6 traffic from reaching affected systems where feasible.",
  "vendor": "Linux",
  "product": "Linux",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= f8f626754ebeca613cf1af2e6f890cfde0e74d5b, < ca96b38730e31357ef4a9d76af1336958ac670d7",
        ">= f8f626754ebeca613cf1af2e6f890cfde0e74d5b, < 531255de8971c06d5d5986f85fdc2525d707ba71",
        ">= f8f626754ebeca613cf1af2e6f890cfde0e74d5b, < 543354c6efb27eae3372a3a9674aeaa2a86e2b2c",
        ">= f8f626754ebeca613cf1af2e6f890cfde0e74d5b, < dc92cb972e86790b8078337ec41015b748b8f8e5",
        ">= f8f626754ebeca613cf1af2e6f890cfde0e74d5b, < 1c70275ca87e769e1a52abc644d61372d8c016cb",
        ">= f8f626754ebeca613cf1af2e6f890cfde0e74d5b, < 1d42828565889632068fbc2983c34d57c66af4e0",
        ">= f8f626754ebeca613cf1af2e6f890cfde0e74d5b, < 4254d5878c320c19961dd0b8e1d0aca4800d8b7d",
        ">= f8f626754ebeca613cf1af2e6f890cfde0e74d5b, < ee319bd3a0e976af5087cbe59ebc50a66f31d202"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "ca96b38730e31357ef4a9d76af1336958ac670d7",
        "531255de8971c06d5d5986f85fdc2525d707ba71",
        "543354c6efb27eae3372a3a9674aeaa2a86e2b2c",
        "dc92cb972e86790b8078337ec41015b748b8f8e5",
        "1c70275ca87e769e1a52abc644d61372d8c016cb",
        "1d42828565889632068fbc2983c34d57c66af4e0",
        "4254d5878c320c19961dd0b8e1d0aca4800d8b7d",
        "ee319bd3a0e976af5087cbe59ebc50a66f31d202"
      ],
      "package_name": "Linux",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "3.8"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Linux",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.008954266666667,
  "t0_at": "2026-10-18T15:17:50.490000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-18T15:17:50.490000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T15:17:50.490000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98532"
    }
  }
}

published 2026-10-22 06:09Z
last change 2026-10-22 07:08Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.