Executive brief
A vulnerability in the Linux kernel's networking stack could allow a remote attacker to cause a system crash. The issue occurs when the system processes specifically formatted network traffic using a performance-optimization feature called Generic Receive Offload (GRO). If exploited, this could lead to a denial-of-service condition, impacting the availability of the affected server or device.
Technical details
A vulnerability in net/core/gro.c exists where skb_gro_receive_list() calls skb_pull() without first validating that the required data is in the linear buffer area using pskb_may_pull(). When packets arrive via napi_gro_frags(), the header length (skb_headlen) may be zero while the GRO offset is non-zero. This causes skb_pull() to decrement the total length without updating the data length, triggering a BUG_ON(skb->len < skb->data_len) in __skb_pull(). An attacker can exploit this via network-delivered packets to cause a kernel panic. The fix introduces a pskb_may_pull() check to ensure data integrity before processing.
Affected products
- Linux Linux 6.10 to 6.12.94, 6.18.36, 7.0.13
Timeline
- 2026-06-04: disclosed: Vulnerability reported by HanQuan and MingXuan
- 2026-06-08: patched: Initial fix committed to mainline kernel
- 2026-06-25: advisory: CVE-2026-53235 published by NVD