{"id":"CVE-2026-80590","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; n…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; n…","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","published":"2026-08-28","updated":"2026-08-29","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80590","references":[{"url":"https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80590.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80590"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525413"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80590"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80590"},{"url":"https://lore.kernel.org/linux-cve-announce/2026082816-CVE-2026-80590-241e@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:86033"},{"url":"https://access.redhat.com/errata/RHSA-2026:88477"},{"url":"https://access.redhat.com/errata/RHSA-2026:87375"},{"url":"https://access.redhat.com/errata/RHSA-2026:87374"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00578,"epssPercentile":0.47417,"ingestedAt":"2026-08-29T21:42:36.773Z","vendor":"Linux","product":"Linux","affected":["Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee","Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < 29dda278a5ed272f2230ff4eaa23cf403107bba0","Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < 14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234","Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < 3edf721bb4b99d272c336631b44e3d8ff9a4f31b","Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < dec2edb7aaf12a8878b3a03172ea8fc277b8eaad","Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace","Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < 69b73b74d9eb45f5560a8fe4fa406ada580e1340","Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < da857e448322a2e871ce3ecc2900027041160d43","Linux >= f43798c27684ab925adde7d8acc34c78c6e50df8 < d5dc1e69fd7258ea605c9952e5d5947539159ae3","Linux 2.6.27"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T19:18:13.413771Z"},"patched":["enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_9"],"cwe":["CWE-843"],"scores":{"nvd":8.6,"vendor":7.7},"slug":"CVE-2026-80590","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment's skb as the head of the reassembled datagram, including its\nshinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()'s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n  kernel BUG at net/core/skbuff.c:4899!\n  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n  CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n  RIP: 0010:skb_segment+0x20ca/0x48b0\n  Call Trace:\n   <TASK>\n   __udp_gso_segment+0x29a/0x27d0\n   udp4_ufo_fragment+0x458/0x6c0\n   inet_gso_segment+0x429/0x1340\n   skb_mac_gso_segment+0x233/0x4f0\n   __skb_gso_segment+0x308/0x660\n   udp_queue_rcv_skb+0x440/0xad0\n   udp_unicast_rcv_skb+0xc7/0x2c0\n   udp_rcv+0x16ce/0x2260\n   ip_protocol_deliver_rcu+0x197/0x2d0\n   ip_local_deliver+0x430/0x690\n   ip_rcv+0x16f/0x1f0\n   __netif_receive_skb_one_core+0x15e/0x1c0\n   __netif_receive_skb+0x1e/0x110\n   netif_receive_skb+0xf6/0x5c0\n   tun_rx_batched.isra.0+0x3ab/0x790\n   tun_get_user+0x17c3/0x3550\n   tun_chr_write_iter+0xba/0x1b0\n   vfs_write+0x646/0x1130\n   </TASK>\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:86033** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86033)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80590.json)\n- **RHSA-2026:88477** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88477)\n- **RHSA-2026:87375** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87375)\n- **RHSA-2026:87374** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87374)","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}