The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b (net: correctly handle tunneled     traffic on IPV6_CSUM GSO fallback) split skb_gso_has_extension_hdr() into mutually exclusive branches on     skb->encapsulation. This did not yet address all paths: 1. With skb->encapsulation set, the outer header     is not checked. IPv6 tunnels such as ip6_gre and ip6_tunnel add an outer Destination Options header by     default (encap_limit). Their GSO packets skip software GSO, then skb_csum_hwoffload_help() sees the outer     extension header and calls skb_checksum_help() on the GSO skb, which warns and drops it. 2. Tunnels over     IPv6 without an outer transport header, such as ip6_tunnel, leave skb->transport_header at the inner     transport header. skb_network_header_len() then spans the outer IPv6, tunnel and inner IP headers, a false     positive. 3. UDP tunnels without an inner network header, such as SCTP-in-UDP or PSP, have no inner IPv6     header to check. Decide on the outer header alone. 4. Directly dereferencing inner_ip_hdr(skb)->version     without skb_header_pointer() is unsafe. Instead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and,     if set, on the inner IPv6 header. Read the headers with skb_header_pointer(). Keep the     skb_network_header_len() check when !skb->encapsulation to also catch encapsulated packets without     skb->encapsulation (e.g., virtio). Use the same helper in skb_csum_hwoffload_help(). Its open coded test     has the false positive of (2) and ignores the inner header. Background: checksum offload of tunneled     packets invariants: Non-GSO skb: - If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload     computes the outer checksum in software and the device offloads only the inner L4 checksum. - If the inner     packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP, Remote Checksum Offload), the device offloads the     outer UDP or GRE checksum instead. GSO skb: - A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or     NETIF_F_GSO_GRE_CSUM computes both inner and outer checksums per segment. The outer checksum is seeded     with only the pseudo-header checksum. A NETIF_F_IPV6_CSUM device must parse through the outer headers to     reach the inner ones. (CVE-2026-98852)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98852

low Nessus Plugin ID 367096

Version 1.2