CVE-2026-72502

tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

State: Published
Severity: 7.5 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.

However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference because local TCP packets do not use frag_list.

Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large.

Also update the stale comment in ip6_default_advmss() which suggested that IPV6_MAXPLEN is returned to mean "any MSS".

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 560b33b434e922ef97f9ff23aa2e909ef7aacd5cAffected 3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 21f69ac1879bb970588d5e7c12a96e6542f7c1a7Affected 3953c46c3ac7eef31a9935427371c6f54a22f1ba to before c0db3dc2ac323b6c4b76adede3b355a9daa6dea8Affected 3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 572fff10819dfc359298d1f774839e76a4d96f93Affected 3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 8e6214a530c03e341dc1b0a846c8f2b716b3551aAffected 3953c46c3ac7eef31a9935427371c6f54a22f1ba to before d774cdbda6634a78d0f2baf201ee5a8c57f3bc0eAffected 3953c46c3ac7eef31a9935427371c6f54a22f1ba to before a210791f33345aa87187f7d7a9f3b9b7f4a28e6dAffected 3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22Affected
LinuxLinux	4.8Affected before 4.8Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 560b33b434e922ef97f9ff23aa2e909ef7aacd5cAffected
3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 21f69ac1879bb970588d5e7c12a96e6542f7c1a7Affected
3953c46c3ac7eef31a9935427371c6f54a22f1ba to before c0db3dc2ac323b6c4b76adede3b355a9daa6dea8Affected
3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 572fff10819dfc359298d1f774839e76a4d96f93Affected
3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 8e6214a530c03e341dc1b0a846c8f2b716b3551aAffected
3953c46c3ac7eef31a9935427371c6f54a22f1ba to before d774cdbda6634a78d0f2baf201ee5a8c57f3bc0eAffected
3953c46c3ac7eef31a9935427371c6f54a22f1ba to before a210791f33345aa87187f7d7a9f3b9b7f4a28e6dAffected
3953c46c3ac7eef31a9935427371c6f54a22f1ba to before 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22Affected

LinuxLinux

4.8Affected
before 4.8Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.