---
id: CVE-2026-98950
title: 'flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

  bpf_flow_dissect() sanitizes the offsets returned by the BPF program
  with clamp_t(u16, ..., hlen).

  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 <
    c44c02c930c6583b235a1937c69ff716c4bb4514
  - >-
    Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 <
    3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a
  - >-
    Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 <
    cc18eb0e9941162c03f03f411ed7f6c339d91fa0
  - >-
    Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 <
    61b43a51a55929ec040bee3ea51af2121b956d05
  - >-
    Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 <
    f202578efc738b883cfa04889eb97328914265a7
  - Linux 4.20
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:19:09.890Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98950'
references:
  - url: 'https://git.kernel.org/stable/c/c44c02c930c6583b235a1937c69ff716c4bb4514'
  - url: 'https://git.kernel.org/stable/c/3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a'
  - url: 'https://git.kernel.org/stable/c/cc18eb0e9941162c03f03f411ed7f6c339d91fa0'
  - url: 'https://git.kernel.org/stable/c/61b43a51a55929ec040bee3ea51af2121b956d05'
  - url: 'https://git.kernel.org/stable/c/f202578efc738b883cfa04889eb97328914265a7'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.557Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

bpf_flow_dissect() sanitizes the offsets returned by the BPF program
with clamp_t(u16, ..., hlen).

If hlen is bigger than 65535, the upper bound is truncated before
the comparison. For instance, with hlen == 65536, both nhoff and
thoff are forced to zero, even if the program returned sane values.

This is the same class of bug as the one fixed in commit 99bda1ecbd56
("flow_dissector: avoid u16 truncation of skb->len when computing
thoff"). That fix does not cover the BPF path, because
__skb_flow_dissect() returns early when a BPF flow dissector
handles the packet.

struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen
to U16_MAX before clamping.

Found by sashiko while reviewing the commit above.

## Affected

- `Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 < c44c02c930c6583b235a1937c69ff716c4bb4514`
- `Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 < 3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a`
- `Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 < cc18eb0e9941162c03f03f411ed7f6c339d91fa0`
- `Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 < 61b43a51a55929ec040bee3ea51af2121b956d05`
- `Linux >= d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 < f202578efc738b883cfa04889eb97328914265a7`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.