{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.190-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: do not let ipv6_find_hdr() return an offset past the packet end  ipv6_find_hdr() walks the extension header chain, skipping each header by the length that header itself declares.  ipv6_optlen() returns up to 2048, and the skip is never checked against skb-\u003elen, so the offset stored in *offset can point past the end of the packet.  openvswitch installs that offset as the transport header, and update_ipv6_checksum() then reads and writes the transport checksum field out of bounds:    BUG: KASAN: slab-use-after-free in inet_proto_csum_replace16+0x445/0x470   Read of size 2 at addr ffff88810b754b06 by task ovs_ipv6_oob/629   CPU: 4 UID: 1000 PID: 629 Comm: ovs_ipv6_oob Tainted: G N 7.3.0-rc3+ #348   Call Trace:    inet_proto_csum_replace16+0x445/0x470    set_ipv6_addr+0x3dd/0x460    do_execute_actions+0x6a3d/0x7c40    ovs_execute_actions+0xfd/0x480    ovs_packet_cmd_execute+0xc38/0xf20    genl_rcv_msg+0x59e/0x870    netlink_rcv_skb+0x18b/0x450    genl_rcv+0x2d/0x40    netlink_unicast+0x6bc/0xa20    The buggy address belongs to the object at ffff88810b754980    which belongs to the cache skbuff_small_head of size 704   The buggy address is located 390 bytes inside of    freed 704-byte region [ffff88810b754980, ffff88810b754c40)  Other callers use that offset too, so bound it here rather than in one caller.  Reject a header whose declared length does not fit in the packet. ipv6_find_hdr() already fails with -EBADMSG on a malformed chain, so this adds no new failure mode.",
  "id": "DEBIAN-CVE-2026-98532",
  "modified": "2026-10-19T04:47:29.626182746Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98532"
    }
  ],
  "upstream": [
    "CVE-2026-98532"
  ]
}