---
id: CVE-2026-98557
title: >-
  kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
  (CVE-2026-98557)
summary: >-
  A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux
  kernel. This vulnerability may allow a local attacker to cause a Denial of
  Service (DoS) by transmitting network traffic that uses User Datagram Protocol
  (UDP) Gener…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-843
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
published: '2026-10-18'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T02:05:45+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98557.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98557.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98557'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555017'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98557'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98557'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98557.mbox
  - url: 'https://git.kernel.org/stable/c/feab3880a72b43913d332c06b75bb80526fa47ba'
  - url: 'https://git.kernel.org/stable/c/dc9e8964a21f20620dbfca4ef3e11eefa7be6451'
  - url: 'https://git.kernel.org/stable/c/83769c23fb1879edc916a526ba424285033baf2d'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00198
epssPercentile: 0.09465
ingestedAt: '2026-10-18T15:45:12.262Z'
---

## Overview

A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by transmitting network traffic that uses User Datagram Protocol (UDP) Generic Segmentation Offload (GSO). Because the driver improperly attempts to read Transmission Control Protocol (TCP) headers on UDP packets, it miscalculates packet header lengths and can submit oversized packet segments to the network device, leading to transmission failures or device stalls.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98557.json)

**kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.

Affected:

- Red Hat Enterprise Linux 10

No fix planned:

- Red Hat Enterprise Linux 10

Not affected:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Fix deferred