Executive brief
The Linux kernel's TCP implementation can crash when processing malformed routing metrics that set advertised maximum segment size (advmss) to zero or extremely small values. This can be triggered by local network configuration or by a remote attacker through crafted routing announcements, causing a denial of service that disrupts network connectivity for affected systems.
Technical details
The vulnerability is a divide-by-zero condition in tcp_select_initial_window() that arises when route-derived advmss values fall below TCP_MIN_MSS. The root cause lies in the TCP stack's failure to clamp advmss metrics to a safe minimum before consuming them; this can occur through explicit RTAX_ADVMSS configuration or implicitly when route MTU and min_adv_mss drive the effective advmss toward zero. The fix introduces a tcp_dst_advmss() helper function that clamps advmss to TCP_MIN_MSS before the TCP stack processes it, preventing the MSS from dropping to zero. The vulnerability affects all kernel versions since Linux 2.6.12-rc2 and requires only network reachability to exploit (no authentication needed). A successful exploit causes kernel panic and service outage.
Affected products
- Linux Linux kernel 2.6.12-rc2 and later (all stable branches before patch)
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched