# flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

CVE record · `CVE-2026-98950`

- **Identifiers:** `CVE-2026-98950`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 23 Oct 2026
- **Updated:** 30 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 23 Oct 2026, 12:19 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to before 46d21495f633e38d40857401504ee51c56ffed2a` (git)
  - affected: `d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to before 6267f8304cbd9ec9f3f53bd227a733e07131492e` (git)
  - affected: `d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to before 99c59062172620a0bac4ae8cf37c83bb78772cdd` (git)
  - affected: `d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to before c44c02c930c6583b235a1937c69ff716c4bb4514` (git)
  - affected: `d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to before 3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a` (git)
  - affected: `d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to before cc18eb0e9941162c03f03f411ed7f6c339d91fa0` (git)
  - affected: `d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to before 61b43a51a55929ec040bee3ea51af2121b956d05` (git)
  - affected: `d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 to before f202578efc738b883cfa04889eb97328914265a7` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.20`
  - unaffected: `before 4.20` (semver)
  - unaffected: `5.10.273 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.224 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.160 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.113 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.57 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.11 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0019, the 8th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 23 Oct 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-98950](https://www.cve.org/CVERecord?id=CVE-2026-98950)
- [NVD: CVE-2026-98950](https://nvd.nist.gov/vuln/detail/CVE-2026-98950)

### References from the CNA

- <https://git.kernel.org/stable/c/46d21495f633e38d40857401504ee51c56ffed2a>
- <https://git.kernel.org/stable/c/6267f8304cbd9ec9f3f53bd227a733e07131492e>
- <https://git.kernel.org/stable/c/99c59062172620a0bac4ae8cf37c83bb78772cdd>
- <https://git.kernel.org/stable/c/c44c02c930c6583b235a1937c69ff716c4bb4514>
- <https://git.kernel.org/stable/c/3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a>
- <https://git.kernel.org/stable/c/cc18eb0e9941162c03f03f411ed7f6c339d91fa0>
- <https://git.kernel.org/stable/c/61b43a51a55929ec040bee3ea51af2121b956d05>
- <https://git.kernel.org/stable/c/f202578efc738b883cfa04889eb97328914265a7>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-98950>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-98950/>. Everything for agents: <https://agentprime.io/llms.txt>.