CVE record · CVE-2026-98852

net: extend IPv6 exthdr detection of tunneled packets

No CVSS scoreEPSS 0.0016 · 4th percentile

Published by the CVE Program (CNA: Linux) at 18 Oct 2026, 15:50 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected ed71cf465c75f5688b07a35d373cd1d6b589c8ea to before fdbd83c2d929ec968b37d2f75149a79440e328ff git affected 33670f780e0120c3dacda188c512bbffe0b6044c to before 44ba9dc568c878b699d05e7cf699572dc9df4b59 git affected a98b78116a27e2a57b696b569b2cb431c95cf9b6 to before aa480f05aed7a9eee87d4a6fc90647fe9679c670 git affected c4336a07eb6b2526dc2b62928b5104b41a7f81f5 to before cabacdf98e09eb74599c4d97d7bd7fd659598fb7 git affected c4336a07eb6b2526dc2b62928b5104b41a7f81f5 to before 5f0764cb1c81a9712bce605d38efe6d844a70b29 git affected 2094a7cf91b71367b649f991aacc7b579f793d0b git affected 732fdeb2987c94b439d51f5cb9addddc2fc48c42 git affected 6.6.134 to before 6.6.160 semver affected 6.12.81 to before 6.12.113 semver affected 6.18.22 to before 6.18.56 semver affected 6.1.168 to before 6.2 semver affected 6.19.12 to before 6.20 semver Other versions: unaffected
Linux	Linux	affected 7.0 unaffected before 7.0 semver unaffected 6.6.160 to 6.6., inclusive semver unaffected 6.12.113 to 6.12., inclusive semver unaffected 6.18.56 to 6.18., inclusive semver unaffected 7.2.10 to 7.2., inclusive semver unaffected 7.3 to *, inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-98852
CNA: Linux
Tags: Linux kernel
Published: 18 Oct 2026
Updated: 21 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0016, the 4th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 18 Oct 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.