Executive brief
The Linux kernel's IPv4 packet fragmentation logic can enter an infinite loop when forwarding packets over network interfaces with extremely small MTU sizes (below 28 bytes). This causes the kernel to continuously allocate and transmit empty header-only fragments, triggering a softlockup timeout and halting system responsiveness. An attacker could exploit this by routing traffic through a device with a misconfigured MTU or using a specially crafted route configuration to cause a denial of service.
Technical details
The vulnerability exists in the ip_do_fragment() function in net/ipv4/ip_output.c. When the effective MTU is smaller than the IPv4 header length (hlen) plus 8 bytes, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state variables (state->left, state->ptr, state->offset) remain unchanged, causing the loop to generate empty fragments indefinitely until the softlockup detector triggers. The fix validates that MTU >= hlen + 8 before fragmentation begins and returns -EMSGSIZE error if the constraint is violated. This patch applies to all Linux kernel versions from 2.6.12-rc2 onwards. No authentication or special privileges are required; any entity that can route traffic through an affected interface with an undersized MTU can trigger this condition.
Affected products
- Linux Linux kernel 2.6.12-rc2 and later (all versions prior to patch)
Timeline
- 2026-09-04: disclosed: Published via NVD and kernel.org
- 2026-08-27: patched: Patch committed upstream (c0726f0caf8c6b3208552949e17d23634a2f3129)