{"id":39073,"date":"2026-10-16T00:34:58","date_gmt":"2026-10-15T16:34:58","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98402"},"modified":"2026-10-16T00:34:58","modified_gmt":"2026-10-15T16:34:58","slug":"cve-2026-98402","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98402","title":{"rendered":"CVE-2026-98402 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: icmp: avoid inva"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: icmp: avoid invalid transport header access in icmp_send tracepoint<\/p>\n<p>syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():<\/p>\n<p> WARNING: at skb_transport_header include\/linux\/skbuff.h:3087 [inline]<br \/>\n WARNING: at udp_hdr include\/linux\/udp.h:23 [inline]<br \/>\n WARNING: at do_trace_event_raw_event_icmp_send include\/trace\/events\/icmp.h:30 [inline]<br \/>\n WARNING: at trace_event_raw_event_icmp_send+0x48c\/0x6ec include\/trace\/events\/icmp.h:11<br \/>\n Call trace:<br \/>\n  skb_transport_header include\/linux\/skbuff.h:3087 [inline]<br \/>\n  udp_hdr include\/linux\/udp.h:23 [inline]<br \/>\n  do_trace_event_raw_event_icmp_send include\/trace\/events\/icmp.h:30 [inline]<br \/>\n  trace_event_raw_event_icmp_send+0x48c\/0x6ec include\/trace\/events\/icmp.h:11<br \/>\n  __traceiter_icmp_send include\/trace\/events\/icmp.h:11 [inline]<br \/>\n  __do_trace_icmp_send include\/trace\/events\/icmp.h:11 [inline]<br \/>\n  trace_icmp_send+0x320\/0x49c include\/trace\/events\/icmp.h:11<br \/>\n  __icmp_send+0xcfc\/0x11d8 net\/ipv4\/icmp.c:1013<br \/>\n  ipv4_send_dest_unreach net\/ipv4\/route.c:1280 [inline]<br \/>\n  ipv4_link_failure+0x57c\/0x8dc net\/ipv4\/route.c:1287<br \/>\n  dst_link_failure include\/net\/dst.h:438 [inline]<br \/>\n  vti_tunnel_xmit+0xe40\/0x17a4 net\/ipv4\/ip_vti.c:307<\/p>\n<p>TP_fast_assign() unconditionally calls udp_hdr(skb) before checking<br \/>\nwhether the packet is UDP. Furthermore, __icmp_send() can be invoked<br \/>\nfrom paths (e.g., link failures, ARP errors, forwarding, AF_PACKET)<br \/>\nwhere skb-&gt;transport_header was never initialized (~0U).<\/p>\n<p>Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers<br \/>\nDEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).<\/p>\n<p>Fix this by:<br \/>\n1. Only parsing transport info when iph-&gt;protocol == IPPROTO_UDP.<br \/>\n2. Using skb_header_pointer() at skb_network_offset(skb) + (iph-&gt;ihl &lt;&lt; 2)<br \/>\n   to safely fetch the UDP header without assuming transport_header is set.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: icmp: avoid invalid transport header access in icmp_send tracepoint<\/p>\n<p>syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39073","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}