Executive brief
The Linux kernel's network packet processing contains a flaw in how it validates BIG TCP aggregation for packets larger than 64KB. Attackers can craft malicious network packets that bypass safety checks, leading to out-of-bounds memory writes and potential kernel crashes or code execution. This impacts any system running affected Linux kernel versions that processes untrusted network traffic.
Technical details
The vulnerability exists in the skb_gro_receive() function in the Linux kernel's GRO (Generic Receive Offload) subsystem. A prior commit loosened validation checks for BIG TCP aggregation, allowing three distinct bypass scenarios: (1) checking skb_headroom() instead of actual MAC header space, permitting crafted frames with insufficient headroom to trigger out-of-bounds writes when ipv6_gro_complete() inserts a temporary HBH jumbo header; (2) allowing non-IP protocols like VLAN (ETH_P_8021Q/ETH_P_8021AD) to aggregate beyond 64KB; and (3) accepting encapsulated flows (SIT/IPv6-in-IPv4) to exceed the 64KB limit. The fix enforces strict criteria: TCP protocol, no encapsulation, and proper MAC header space for IPv6. Network-reachable attackers can inject crafted frames via raw sockets (AF_PACKET) to trigger kernel memory corruption. Patches are available for affected stable branches (6.18.y and earlier); mainline kernel (7.0+) is unaffected due to subsystem rewrite.
Affected products
- Linux Linux Kernel 6.18.y and earlier stable branches (not 7.0+)
Timeline
- 2026-08-29: disclosed