{"id":"CVE-2026-22979","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in skb_segment_list for GRO packets\n\nWhen skb_segment_list() is called during packet forwarding, it handles\npackets that were aggregated by the GRO…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in skb_segment_list for GRO packets\n\nWhen skb_segment_list() is called during packet forwarding, it handles\npackets that were aggregated by the GRO…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-401","CWE-772"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.15.154, < 5.16","linux_kernel >= 6.1.85, < 6.1.161","linux_kernel >= 6.6.26, < 6.6.121","linux_kernel >= 6.8.5, < 6.9","linux_kernel >= 6.9.1, < 6.12.66","linux_kernel >= 6.13, < 6.18.6","linux_kernel = 6.9","linux_kernel = 6.19"],"patched":["linux_kernel 6.18.6"],"published":"2026-01-23","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:18:38.290","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-22979","references":[{"url":"https://git.kernel.org/stable/c/0b27828ebd1ed3107d7929c3737adbe862e99e74","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/238e03d0466239410b72294b79494e43d4fabe77","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3264881431e308b9c72cb8a0159d57a56d67dd79","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88bea149db2057112af3aaf63534b24fab5858ab","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c114a32a2e70b82d447f409f7ffcfa3058f9d5bd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22979.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-22979"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2432402"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22979"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22979"},{"url":"https://lore.kernel.org/linux-cve-announce/2026012347-CVE-2026-22979-b883@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:38491"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00142,"epssPercentile":0.03484,"ingestedAt":"2026-09-08T15:33:26.994Z","slug":"CVE-2026-22979","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in skb_segment_list for GRO packets\n\nWhen skb_segment_list() is called during packet forwarding, it handles\npackets that were aggregated by the GRO engine.\n\nHistorically, the segmentation logic in skb_segment_list assumes that\nindividual segments are split from a parent SKB and may need to carry\ntheir own socket memory accounting. Accordingly, the code transfers\ntruesize from the parent to the newly created segments.\n\nPrior to commit ed4cccef64c1 (\"gro: fix ownership transfer\"), this\ntruesize subtraction in skb_segment_list() was valid because fragments\nstill carry a reference to the original socket.\n\nHowever, commit ed4cccef64c1 (\"gro: fix ownership transfer\") changed\nthis behavior by ensuring that fraglist entries are explicitly\norphaned (skb->sk = NULL) to prevent illegal orphaning later in the\nstack. This change meant that the entire socket memory charge remained\nwith the head SKB, but the corresponding accounting logic in\nskb_segment_list() was never updated.\n\nAs a result, the current code unconditionally adds each fragment's\ntruesize to delta_truesize and subtracts it from the parent SKB. Since\nthe fragments are no longer charged to the socket, this subtraction\nresults in an effective under-count of memory when the head is freed.\nThis causes sk_wmem_alloc to remain non-zero, preventing socket\ndestruction and leading to a persistent memory leak.\n\nThe leak can be observed via KMEMLEAK when tearing down the networking\nenvironment:\n\nunreferenced object 0xffff8881e6eb9100 (size 2048):\n  comm \"ping\", pid 6720, jiffies 4295492526\n  backtrace:\n    kmem_cache_alloc_noprof+0x5c6/0x800\n    sk_prot_alloc+0x5b/0x220\n    sk_alloc+0x35/0xa00\n    inet6_create.part.0+0x303/0x10d0\n    __sock_create+0x248/0x640\n    __sys_socket+0x11b/0x1d0\n\nSince skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST\npackets constructed by GRO, the truesize adjustment is removed.\n\nThe call to skb_release_head_state() must be preserved. As documented in\ncommit cf673ed0e057 (\"net: fix fraglist segmentation reference count\nleak\"), it is still required to correctly drop references to SKB\nextensions that may be overwritten during __copy_skb_header().\n\n## Affected\n\n- `linux_kernel >= 5.15.154, < 5.16`\n- `linux_kernel >= 6.1.85, < 6.1.161`\n- `linux_kernel >= 6.6.26, < 6.6.121`\n- `linux_kernel >= 6.8.5, < 6.9`\n- `linux_kernel >= 6.9.1, < 6.12.66`\n- `linux_kernel >= 6.13, < 6.18.6`\n- `linux_kernel = 6.9`\n- `linux_kernel = 6.19`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.18.6`\n\n## Vendor advisories\n\n- **RHSA-2026:38491** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38491)\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · updated 2026-10-13 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22979.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":220111,"id":"CVE-2026-22979","ts":1791978559740,"field":"cvss","old":null,"new":"5.5"},{"seq":220110,"id":"CVE-2026-22979","ts":1791978559740,"field":"severity","old":"none","new":"medium"}]}