Executive brief
The Linux kernel's Generic UDP Encapsulation (GUE) implementation contains a flaw in validating remote checksum offload metadata in network packets. Attackers can craft malformed packets that bypass option validation, potentially leading to memory corruption or denial of service on systems processing these packets.
Technical details
The vulnerability exists in the GUE packet option validation logic, specifically in the guehdr_priv_flags_len() function in include/net/gue.h. When the GUE_PFLAG_REMCSUM flag is set, the function incorrectly returns 0 instead of accounting for the required GUE_PLEN_REMCSUM metadata length. This allows malformed packets containing only the private flags field to pass validate_gue_flags(), after which the subsequent gue_remcsum() and gue_gro_remcsum() functions attempt to read the missing REMCSUM start/offset fields from unvalidated packet data. The fix correctly returns GUE_PLEN_REMCSUM when the REMCSUM flag is present, ensuring malformed packets are rejected during validation. No user interaction is required; the vulnerability is triggered by network-reachable packet processing.
Affected products
- Linux Linux kernel multiple versions (patched upstream, various stable branches)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched