{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "3347c960295583eee3fd58e5c539fb1972fbc005"
            },
            {
              "fixed": "c949646c900e879afce47df1b607fa320eb63bf2"
            },
            {
              "fixed": "006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.13.0"
            },
            {
              "fixed": "7.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98853.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUse the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first\nfive entries pass, and the sixth returns -EINVAL before dispatching\nanother GSO callback.",
  "id": "CVE-2026-98853",
  "modified": "2026-10-20T02:31:05.434096627Z",
  "published": "2026-10-18T15:51:02.683Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98853.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98853"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "net: gso: limit recursive IP-in-IP segmentation"
}