Junglewise Threat Intelligence

CVE-2026-23154: Linux Kernel protocol inconsistency in fraglist GRO forwarding

CVE-2026-23154 · Severity: medium · CVSS 5.5 · Published 2026-02-14

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability in the Linux kernel's networking component can cause significant performance degradation or service instability when forwarding network traffic between IPv4 and IPv6 networks. This issue specifically affects systems acting as hotspots or gateways using protocol translation (XLAT). An exploit could lead to protocol inconsistencies and reduced network throughput, potentially impacting the availability of connected services.

Technical details

A vulnerability exists in the Linux kernel's Generic Segmentation Offload (GSO) handling when forwarding Generic Receive Offload (GRO) packets containing a frag_list. The root cause is that the skb_segment_list function cannot correctly process skbs converted by XLAT because XLAT only translates the header of the head skb, leaving subsequent skbs in the frag_list untranslated. This results in protocol inconsistencies during forwarding. The fix involves explicitly setting the SKB_GSO_DODGY flag in XLAT's protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4), forcing the kernel to fall back to the safer skb_segment function instead of skb_segment_list.

Affected products

  • Linux Linux Kernel Fixed in 2cbef9ea5a0ac51863ede35c45f26931a85d3888, 3d48d59235c494d34e32052f768393111c0806ef, 3e62db1e3140449608975e29e0979cc5f3b1cc07, 426ca15c7f6cb6562a081341ca88893a50c59fa2, 9122d7280b2303e835cdfec156bd932ac1f586ed
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-02-14: advisory: Initial publication date
  • 2026-02-06: patched: Kernel stable tree commit 3d48d59235c494d34e32052f768393111c0806ef

References

Related threats