Is there a patch available for CVE-2026-98402?

Yes, a patch is available for CVE-2026-98402. Update the affected software to the latest version immediately.

Linux CVE-2026-98402

EUVD-2026-101051

2026-10-14 Linux

GHSA-ggf3-fm45-ccm2

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: icmp: avoid invalid transport header access in icmp_send tracepoint

syzbot reported a WARNING triggered by DEBUG_NET_WARN_ON_ONCE():

WARNING: at skb_transport_header include/linux/skbuff.h:3087 [inline] WARNING: at udp_hdr include/linux/udp.h:23 [inline] WARNING: at do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] WARNING: at trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 Call trace: skb_transport_header include/linux/skbuff.h:3087 [inline] udp_hdr include/linux/udp.h:23 [inline] do_trace_event_raw_event_icmp_send include/trace/events/icmp.h:30 [inline] trace_event_raw_event_icmp_send+0x48c/0x6ec include/trace/events/icmp.h:11 __traceiter_icmp_send include/trace/events/icmp.h:11 [inline] __do_trace_icmp_send include/trace/events/icmp.h:11 [inline] trace_icmp_send+0x320/0x49c include/trace/events/icmp.h:11 __icmp_send+0xcfc/0x11d8 net/ipv4/icmp.c:1013 ipv4_send_dest_unreach net/ipv4/route.c:1280 [inline] ipv4_link_failure+0x57c/0x8dc net/ipv4/route.c:1287 dst_link_failure include/net/dst.h:438 [inline] vti_tunnel_xmit+0xe40/0x17a4 net/ipv4/ip_vti.c:307

TP_fast_assign() unconditionally calls udp_hdr(skb) before checking whether the packet is UDP. Furthermore, __icmp_send() can be invoked from paths (e.g., link failures, ARP errors, forwarding, AF_PACKET) where skb->transport_header was never initialized (~0U).

Under CONFIG_DEBUG_NET=y, calling skb_transport_header(skb) triggers DEBUG_NET_WARN_ON_ONCE(!skb_transport_header_was_set(skb)).

Fix this by:

Only parsing transport info when iph->protocol == IPPROTO_UDP.
Using skb_header_pointer() at skb_network_offset(skb) + (iph->ihl << 2)

to safely fetch the UDP header without assuming transport_header is set.

Affected VersionsENISA

Linux db3efdcf70c752e8a8deb16071d8e693c3ef8746 <7fcc2fe39fed1cb98a7374a113ff3800e8f9af80

Linux db3efdcf70c752e8a8deb16071d8e693c3ef8746 <04c0d35bac5122b533672a6775851dfae84e265e

Linux patch: 7.3-rc2

Linux db3efdcf70c752e8a8deb16071d8e693c3ef8746 <b972b5e6168dc5d1e13297b1f37f71d6b21cc0f1

Linux patch: 0

Linux patch: 6.12.111

Linux 6.10

Linux patch: 6.6.158

Linux patch: 7.2.7

Linux patch: 6.18.53

Linux db3efdcf70c752e8a8deb16071d8e693c3ef8746 <2b32f8c3560905582fb12ed68315a6e606367a6a

Linux 6.1.130 <6.1.189

Linux patch: 6.1.189

Linux 21b28f97e621cba196fb32c576734d216a8a79c9 <99654b651c6d5fe865798a2adb859767905f9278

Linux 524c341cb16a8d5318d2ffacf6fe160271a18743 <ec6d4612d1c170e1cef1fe55526471da1e81e777

Linux 6.6.81 <6.6.158

Affected Packages

euvd linux fix: 6.1.189, 6.6.158

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 14, 2026 - 15:03 EUVD

CVE Published

Oct 14, 2026 - 13:26 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.