Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow the processing of specially crafted malicious network packets. The Linux kernel is the core component of many operating systems used in servers, desktops, and embedded devices. If exploited, this flaw could lead to system instability or crashes by providing malformed data to network drivers that expect specific packet structures.
Technical details
A vulnerability exists in the Linux kernel networking stack within the `qdisc_pkt_len_segs_init()` function. Most `ndo_start_xmit()` methods expect GSO packet headers to reside in `skb->head`, but the kernel was using `skb_header_pointer()` which does not guarantee this placement. This is particularly dangerous for `net/core/tso.c` users where `tso_build_hdr()` performs a `memcpy` from `skb->data`. An attacker can send malicious packets that bypass these expectations, potentially causing out-of-bounds access or crashes. The fix replaces `skb_header_pointer()` with `pskb_may_pull()` to ensure headers are correctly linearized and introduces a new drop reason (`SKB_DROP_REASON_SKB_BAD_GSO`) to reject malformed packets early.
Affected products
- Linux Linux Kernel 3.16 to 7.0.10
Timeline
- 2026-04-03: other: Patch authored by Eric Dumazet
- 2026-06-24: disclosed: CVE published in NVD dataset