Executive brief
A vulnerability in the Linux kernel's networking component could allow an attacker to disrupt network services. The issue stems from how the system handles specific types of complex IPv6 network traffic, particularly when data is 'tunneled' or wrapped inside other protocols. If exploited, this could lead to a system crash or significant network performance degradation, impacting the availability of connected services and industrial equipment.
Technical details
A vulnerability exists in the Linux kernel's 'net' subsystem due to improper handling of tunneled traffic during IPV6_CSUM GSO fallback. The NETIF_F_IPV6_CSUM flag only supports checksum offloading for packets without IPv6 extension headers; packets with these headers must fall back to software checksumming. The previous implementation failed to check the inner header length for tunneled packets (such as RFC 6951 SCTP in UDP), causing them to bypass the necessary software GSO path. This logic error can be triggered by remote network traffic, potentially leading to kernel instability or denial of service. Patches have been released across multiple Linux stable branches to extend header checks to inner protocols.
Affected products
- Linux Linux Kernel Fixed in 2094a7cf91b71367b649f991aacc7b579f793d0b and related stable branches
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-05-01: disclosed: CVE published
- 2026-04-11: patched: Kernel stable branches updated
References
- https://git.kernel.org/stable/c/2094a7cf91b71367b649f991aacc7b579f793d0b
- https://git.kernel.org/stable/c/33670f780e0120c3dacda188c512bbffe0b6044c
- https://git.kernel.org/stable/c/732fdeb2987c94b439d51f5cb9addddc2fc48c42
- https://git.kernel.org/stable/c/a98b78116a27e2a57b696b569b2cb431c95cf9b6
- https://git.kernel.org/stable/c/c4336a07eb6b2526dc2b62928b5104b41a7f81f5
- https://git.kernel.org/stable/c/ed71cf465c75f5688b07a35d373cd1d6b589c8ea
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html