CVE-2026-43036

net: use skb_header_pointer() for TCPv4 GSO frag_off check

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: Oct 30, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: use skb_header_pointer() for TCPv4 GSO frag_off check

Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1].

gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths.

Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying.

[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cbc53e08a793b073e79f42ca33f1f3568703540d to before 362bacb37d88a178bfaefc4484623eae44425a70Affected cbc53e08a793b073e79f42ca33f1f3568703540d to before 5057502630fbc8ce468ff617ff59af275960b537Affected cbc53e08a793b073e79f42ca33f1f3568703540d to before f7a6cd508e9e825a2c69fa9e13d41ee156852f25Affected cbc53e08a793b073e79f42ca33f1f3568703540d to before cc91202fc20a44aab4c206f12a2bfe05da936051Affected cbc53e08a793b073e79f42ca33f1f3568703540d to before d970341cfa5594614c7a6634886c7688b4f5cafdAffected cbc53e08a793b073e79f42ca33f1f3568703540d to before ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0Affected
LinuxLinux	4.7Affected before 4.7Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

cbc53e08a793b073e79f42ca33f1f3568703540d to before 362bacb37d88a178bfaefc4484623eae44425a70Affected
cbc53e08a793b073e79f42ca33f1f3568703540d to before 5057502630fbc8ce468ff617ff59af275960b537Affected
cbc53e08a793b073e79f42ca33f1f3568703540d to before f7a6cd508e9e825a2c69fa9e13d41ee156852f25Affected
cbc53e08a793b073e79f42ca33f1f3568703540d to before cc91202fc20a44aab4c206f12a2bfe05da936051Affected
cbc53e08a793b073e79f42ca33f1f3568703540d to before d970341cfa5594614c7a6634886c7688b4f5cafdAffected
cbc53e08a793b073e79f42ca33f1f3568703540d to before ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0Affected

LinuxLinux

4.7Affected
before 4.7Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.