Riskcovery

CVE-2026-53091

net: pull headers in qdisc_pkt_len_segs_init()

State
Published
Severity
8.4 High
Published
Jun 24, 2026
Updated
Oct 21, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: pull headers in qdisc_pkt_len_segs_init()

Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.

net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len);

qdisc_pkt_len_segs_init() already does a dissection of gso packets.

Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this.

Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

Scores

CVSSScoreVectorSource
3.18.4 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:HLinux
3.17.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-131 Incorrect Calculation of Buffer Size

Affected Products

ProductVersions
LinuxLinux
  • e876f208af18b074f800656e4d1b99da75b2135f to before 5895cfc76924a629c6eaa5e5f049de642860045fAffected
  • e876f208af18b074f800656e4d1b99da75b2135f to before 7564dc804d8289d2e5c6edb8173754051b71bff4Affected
  • e876f208af18b074f800656e4d1b99da75b2135f to before 9d4f5c68f5ad4ab425f3ce1500c97c9f9743999aAffected
  • e876f208af18b074f800656e4d1b99da75b2135f to before 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4Affected
LinuxLinux
  • 3.16Affected
  • before 3.16Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 7.0.10 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.