CVE-2026-80590

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: strip GSO state from fragments before reassembly

A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark

an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.

inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first

fragment's skb as the head of the reassembled datagram, including its

shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments

on frag_list with whatever linear/paged layout they arrived with.

After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the

reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and

the next software segmentation point - udp_rcv_segment() on local

delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow

path - hands it to skb_segment(). skb_segment()'s frag_list walk

assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to

a tap by an unprivileged user in its own userns are

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References