Executive brief
The Linux kernel's virtio-net driver processes network packets with user-specified segmentation parameters. An attacker can craft malicious packets with abnormally small segment sizes through raw packet sockets, causing the kernel to miscalculate the number of segments and overflow a 16-bit field, potentially leading to kernel memory corruption or denial of service.
Technical details
This vulnerability exists in the virtio-net driver's generic segmentation offload (GSO) handling code within include/linux/virtio_net.h. The root cause is insufficient validation of the gso_size parameter for TCP packets: users can specify gso_size values smaller than TCP_MIN_GSO_SIZE (8 bytes) via AF_PACKET PACKET_VNET_HDR sockets. When dividing the socket buffer (SKB) length by this undersized gso_size, the calculated number of segments can exceed the 16-bit limit (GSO_MAX_SEGS = 65535), causing integer overflow. The attack requires local network access and the ability to create raw packets, but does not require elevated privileges. The fix enforces a minimum gso_size of 8 for TCP packets via the constraint: gso_size = max(gso_size, TCP_MIN_GSO_SIZE). Patches have been committed and backported across multiple kernel versions.
Affected products
- Linux Linux kernel multiple versions prior to fix (2.6.11 through 7.2)
Timeline
- 2026-09-17: disclosed: CVE published on NVD
- 2026-08-22: patched: Upstream commit c27c449d455aafd9018a3cbab150f1c42c87923f authored; backports to stable branches completed by 2026-09-14
- 2026-09-14: other: Stable kernel backports merged