Executive brief
A vulnerability in the Linux kernel's networking component could allow a local attacker to cause network processing errors. The issue affects how the system handles high-speed data packet merging (GRO) for certain types of encapsulated traffic. This can lead to incorrect checksum calculations, potentially resulting in dropped packets or service disruptions for applications relying on specific network configurations.
Technical details
The vulnerability exists in the UDP GRO (Generic Receive Offload) completion stage of the Linux kernel. The `udp4_gro_complete()` function incorrectly assumes that the `encapsulation` flag is always zeroed for incoming packets. However, certain hardware NICs, the tun driver, or veth setups can set this flag during hardware offloading or GSO packet injection. This causes the kernel to use an incorrect network offset (inner instead of outer) when computing the UDP header pseudo-checksum. The resulting checksum validation errors can lead to packet drops or denial of service for affected network streams. The fix involves explicitly clearing the encapsulation flag during the GRO completion phase.
Affected products
- Linux Linux Kernel 6.8.10 to 6.9, 6.13 to 6.18.10, 6.6.31 to 6.6.124, 6.9.1 to 6.12.70
Timeline
- 2026-02-02: patched: Initial patch authored by Paolo Abeni
- 2026-03-18: disclosed: CVE-2026-23254 published