CVE-2026-97984 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems, especially those with unusually large MTUs, should assess exposure and prioritize verification of affected systems. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, defenders should consider implementing to

Why it matters

A Linux kernel vulnerability allows for a UDP length overflow when using PMTU discovery with large MTUs, triggering a WARN in udp_set_len_short. Defenders should assess exposure and prioritize verification of affected systems.

• Verify if systems are using affected kernel versions
• Monitor for unusual UDP traffic
• Assess exposure of systems with large MTUs
• Consider implementing compensating controls for UDP traffic

Technical summary

The Linux kernel vulnerability (CVE-2026-97984) occurs when using PMTU discovery with large MTUs, causing a UDP length overflow and triggering a WARN in udp_set_len_short. This affects UDP sockets and was introduced by commit 427faee167bc. The vulnerability can be triggered by setting the device MTU larger than IP6_MAX_MTU, setting IPV6_MTU_DISCOVER to IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and sending a large packet. The issue has been resolved by bounding cork->base.fragsize to IP6_MAX_MTU for UDP sockets to avoid the overflow.

Defensive priority

Defenders should assess exposure and prioritize verification of affected systems, especially those with unusually large MTUs.

Recommended defensive actions

• Assess exposure of systems with large MTUs
• Verify if systems are using affected kernel versions
• Monitor for unusual UDP traffic
• Consider implementing compensating controls for UDP traffic
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify affected or fixed versions. The Linux kernel community has resolved the issue. Further verification is needed to assess exposure and identify potentially affected systems, especially those with unusually large MTUs. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.