{"id":"CVE-2026-98485","title":"kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (CVE-2026-98485)","summary":"A flaw was found in the Linux kernel's netfilter subsystem. This flaw allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted IPv6 packets to an affected system. The issue occurs when an IPv6 routing header…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-10-18","updated":"2026-10-24","sourceUpdated":"2026-10-24T14:23:18+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98485.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98485.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98485"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554861"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98485"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98485"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98485.mbox"},{"url":"https://git.kernel.org/stable/c/959d1829d1ce8b91b435b24a923b51bcc8897090"},{"url":"https://git.kernel.org/stable/c/fe336bab13834394320997de8b16ca4a913b4f13"},{"url":"https://git.kernel.org/stable/c/5a54f8b7f7fe207a5c14713015a5820588faf1ad"},{"url":"https://git.kernel.org/stable/c/b89249819a7d6698bed152feafd3bc6c08489d15"},{"url":"https://git.kernel.org/stable/c/dd55c0ea87bf70e4e4b3b683acd29ef981335b26"},{"url":"https://git.kernel.org/stable/c/191239b0939692e92459d8d32cad14247fa93f89"},{"url":"https://git.kernel.org/stable/c/d9cf4ac6f326330e1fe4d95671d36a6ff3593f64"},{"url":"https://git.kernel.org/stable/c/82313c169eddc02b1bf5ba6b427803e272d3ec42"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00173,"epssPercentile":0.06666,"scores":{"vendor":5.9,"cna":7.1},"ingestedAt":"2026-10-18T15:45:12.294Z","slug":"CVE-2026-98485","body":"## Overview\n\nA flaw was found in the Linux kernel's netfilter subsystem. This flaw allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted IPv6 packets to an affected system. The issue occurs when an IPv6 routing header match rule is configured with zero addresses, causing the packet inspection loop to bypass its termination condition. Consequently, processing matching packets triggers an out-of-bounds memory read, leading to a kernel crash.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98485.json)\n\n**kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-24.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":229537,"id":"CVE-2026-98485","ts":1793019837499,"field":"cvss","old":"7.1","new":"5.9"},{"seq":229536,"id":"CVE-2026-98485","ts":1793019837499,"field":"severity","old":"high","new":"medium"},{"seq":228958,"id":"CVE-2026-98485","ts":1792854121014,"field":"cvss","old":null,"new":"7.1"},{"seq":228957,"id":"CVE-2026-98485","ts":1792854121014,"field":"severity","old":"none","new":"high"}]}