Executive brief
The Linux kernel's network stack can corrupt packet data structures (skbs) during segmentation when GRO-optimized packets are forwarded through bridges to multiple destinations. This memory corruption can cause kernel crashes, data loss, or potentially allow an attacker on the network to crash the system or execute code by crafting malicious packets, impacting systems that rely on the kernel for network connectivity and bridging.
Technical details
This vulnerability is a use-after-free / memory corruption issue in the kernel's Generic Receive Offload (GRO) and segmentation code paths (net/ipv4/udp_offload.c, net/core/gro.c). The root cause is unsafe writes to cloned skbs with shared buffer heads when segmenting GRO-ed packets that are forwarded via bridges to both local and egress devices. When rx-gro-list packets flow through a bridge, the segmentation logic corrupts shared skb metadata, triggering NULL pointer dereferences and kernel oops as observed in __udp_gso_segment(). The attack vector is network-based; an attacker sending specially crafted packets that trigger GRO aggregation and bridging can crash the kernel remotely. The fix involves uncloning skbs before segmentation to prevent unsafe writes to shared structures. Patches are available in the Linux kernel's upstream repository.
Affected products
- Linux Linux kernel multiple versions prior to the fix (advisory does not specify exact version range)
Timeline
- 2025-12-24: disclosed: CVE-2023-54094 published