CVE-2026-98417: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98417 is a vulnerability in the Linux kernel's XFRM (IPsec) subsystem affecting the ESP-in-TCP (espintcp) implementation. When the stream parser trims the TCP envelope from an ESP-in-TCP packet, the resulting transport header offset may no longer be representable, causing a plain transport header reset to truncate the offset and trigger the kernel's skb (socket buffer) warning path. The vulnerability affects Linux kernel versions starting from 5.6 up to the fixed stable releases. It was published on October 14, 2026, and carries an estimated CVSS severity of Medium (Feedly, ENISA EUVD).

The root cause is improper handling of transport header offsets in the net/xfrm espintcp code path (CWE-20: Improper Input Validation). When the TCP stream parser strips the TCP framing from an ESP-in-TCP packet, the resulting transport header offset can exceed the representable range for the skb transport header field; the unchecked plain reset then silently truncates the value, triggering a kernel warning (WARN_ON). The fix replaces the plain transport-header reset with a "careful" helper that validates the offset and drops the skb via the existing XFRM error path if the offset cannot be represented, preventing the warning and any downstream misuse of the corrupted offset (Feedly, Kernel Git).

Successful triggering of this vulnerability can cause kernel warning splats and potential denial-of-service conditions on systems using ESP-in-TCP (IPsec over TCP). The corrupted transport header offset could lead to incorrect packet processing within the XFRM subsystem, potentially affecting the availability and integrity of IPsec-protected network communications. There is no current evidence of confidentiality impact or remote code execution; the primary risk is availability disruption on affected Linux systems processing ESP-in-TCP traffic (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-98417 as of the time of disclosure. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation would require the ability to send crafted ESP-in-TCP network traffic to a vulnerable system with IPsec/XFRM configured to use espintcp (Feedly, ENISA EUVD).

The Linux kernel maintainers have released fixes across all supported stable branches. Administrators should update to the following patched versions or later: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, or 7.3-rc4 (mainline). The fix is also available as specific git commits in each stable tree (e.g., 96f01b53c2d05e003b040892256de54a586e8529 for one branch). As a temporary workaround where patching is not immediately possible, disabling ESP-in-TCP (espintcp) in the XFRM/IPsec configuration will prevent the vulnerable code path from being reached (Feedly, ENISA EUVD).