# CVE-2026-98371: Linux kernel xfrm iptfs denial of service via short inner tot_len

Source: https://junglewise.ai/threats/cve-2026-98371-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-98371 · Severity: info · Published 2026-10-06

A vulnerability in the Linux kernel's xfrm IPTFS (IP Traffic Flow Security) component allows an attacker to trigger a kernel panic, causing a system denial of service. This affects systems running VPN gateways using IPTFS or systems with local container/namespace access. An attacker can exploit this by sending specially crafted network packets with malformed headers, leading to an immediate and uncontrolled system crash.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-98371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-98371 being exploited in the wild.

**How severe is CVE-2026-98371?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** Linux Kernel unspecified.

**Is there a fix for CVE-2026-98371?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-98371 attacked?** It is attacked over the network or with local access, in an operating system.

**Am I affected by CVE-2026-98371?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the runt packet reassembly path of the IPTFS implementation, where insufficient validation of the declared inner packet length allows a buffer overflow and integer underflow in __iptfs_iphlen() processing. When an IPv4 packet header is split across outer packets with a declared length between 6 and 19 bytes, the reassembly logic incorrectly calculates payload copy lengths, leading to skb_over_panic() in the kernel. The fix requires validating that the declared inner length covers at least the minimum IP header size before allocating reassembly buffers.

## Affected products

- Linux kernel unspecified

## Timeline

- 2026-10-06: disclosed

## Related threats

- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel PMC uninitialized clock rate in 32-bit Tegra](https://junglewise.ai/threats/cve-2026-99259-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel x86 Hyper-V memory access violation](https://junglewise.ai/threats/cve-2026-99258-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel io_uring signal loss in worker exit](https://junglewise.ai/threats/cve-2026-99228-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel mv643xx_eth NULL pointer dereference in PHY probe](https://junglewise.ai/threats/cve-2026-99197-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)