{"id":"CVE-2026-98557","title":"kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO (CVE-2026-98557)","summary":"A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by transmitting network traffic that uses User Datagram Protocol (UDP) Gener…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-843","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["enterprise_linux 10"],"published":"2026-10-18","updated":"2026-10-20","sourceUpdated":"2026-10-20T02:05:45+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98557.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98557.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98557"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555017"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98557"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98557"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98557.mbox"},{"url":"https://git.kernel.org/stable/c/feab3880a72b43913d332c06b75bb80526fa47ba"},{"url":"https://git.kernel.org/stable/c/dc9e8964a21f20620dbfca4ef3e11eefa7be6451"},{"url":"https://git.kernel.org/stable/c/83769c23fb1879edc916a526ba424285033baf2d"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00198,"epssPercentile":0.09465,"ingestedAt":"2026-10-18T15:45:12.262Z","slug":"CVE-2026-98557","body":"## Overview\n\nA flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by transmitting network traffic that uses User Datagram Protocol (UDP) Generic Segmentation Offload (GSO). Because the driver improperly attempts to read Transmission Control Protocol (TCP) headers on UDP packets, it miscalculates packet header lengths and can submit oversized packet segments to the network device, leading to transmission failures or device stalls.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98557.json)\n\n**kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225816,"id":"CVE-2026-98557","ts":1792498463238,"field":"cvss","old":null,"new":"5.5"},{"seq":225815,"id":"CVE-2026-98557","ts":1792498463238,"field":"severity","old":"none","new":"medium"}]}