Executive brief
A vulnerability in the Linux kernel's networking subsystem could cause legitimate network traffic to be dropped unexpectedly. This occurs when specific types of network packets (UDP with Generic Segmentation Offload) are processed by the firewall's connection tracking system. While primarily a stability and performance issue, it can lead to service disruptions for applications relying on high-speed network processing.
Technical details
A regression was identified in the nfnetlink_queue component of the Linux kernel's netfilter subsystem. When an application does not set the 'F_GSO' capability flag, GSO packets with unconfirmed nf_conn entries are dropped because the shared-unconfirmed check occurs after skb_gso_segment(). This segmentation causes an elevated reference count due to skb_clone(), leading the kernel to incorrectly assume it does not have exclusive ownership of the connection tracking entry. The fix moves the check to occur before segmentation on the aggregated packet and adds annotations for individual segments to allow a secondary check during reinjection. This issue specifically affects UDP traffic, as TCP SYN packets are not aggregated by GRO.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026-02-06
Timeline
- 2025-11-20: other: Patch authored
- 2026-02-06: patched: Patch committed to stable tree
- 2026-05-27: disclosed: CVE published