{"id":"CVE-2026-98853","title":"net: gso: limit recursive IP-in-IP segmentation","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 3347c960295583eee3fd58e5c539fb1972fbc005 < c949646c900e879afce47df1b607fa320eb63bf2","Linux >= 3347c960295583eee3fd58e5c539fb1972fbc005 < 006c8b834aed8b02bd8fb9fb05e9e7ead37d1763","Linux 3.13"],"published":"2026-10-18","updated":"2026-10-19","sourceUpdated":"2026-10-19T09:26:48.042Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98853","references":[{"url":"https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2"},{"url":"https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.462Z","slug":"CVE-2026-98853","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUse the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first\nfive entries pass, and the sixth returns -EINVAL before dispatching\nanother GSO callback.\n\n## Affected\n\n- `Linux >= 3347c960295583eee3fd58e5c539fb1972fbc005 < c949646c900e879afce47df1b607fa320eb63bf2`\n- `Linux >= 3347c960295583eee3fd58e5c539fb1972fbc005 < 006c8b834aed8b02bd8fb9fb05e9e7ead37d1763`\n- `Linux 3.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}