CVE-2026-80793

ipv4: reject undersized MTUs in ip_do_fragment()

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: reject undersized MTUs in ip_do_fragment()

ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next().

If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires.

This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20.

Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a716a64a4ba68cd46f2745fba2b1099fe8e0aa59Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 515b6816ba0c12d8415c88e5f41e6ec029e35cfaAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 74ce7389f8f562d39015f59a00ef7ad6acd37803Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b0ea911453ce7210e8200a07a94d2458bd1e6430Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 36e0741833bd823866f8cb9f112f37cea1a70b60Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d9d1a676b033acabf8e5645f730486d1f8204a3fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3556beb8ca86677af2aca5bfbed6f8e790fccc83Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c8a74adccaf028223054633b532593101dfcc581Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c0726f0caf8c6b3208552949e17d23634a2f3129Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.267 through 5.10.Not affected 5.15.218 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.154 through 6.6.Not affected 6.12.106 through 6.12.Not affected 6.18.47 through 6.18.Not affected 7.1.11 through 7.1.Not affected 7.2.1 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a716a64a4ba68cd46f2745fba2b1099fe8e0aa59Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 515b6816ba0c12d8415c88e5f41e6ec029e35cfaAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 74ce7389f8f562d39015f59a00ef7ad6acd37803Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b0ea911453ce7210e8200a07a94d2458bd1e6430Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 36e0741833bd823866f8cb9f112f37cea1a70b60Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d9d1a676b033acabf8e5645f730486d1f8204a3fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3556beb8ca86677af2aca5bfbed6f8e790fccc83Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c8a74adccaf028223054633b532593101dfcc581Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c0726f0caf8c6b3208552949e17d23634a2f3129Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.267 through 5.10.*Not affected
5.15.218 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.154 through 6.6.*Not affected
6.12.106 through 6.12.*Not affected
6.18.47 through 6.18.*Not affected
7.1.11 through 7.1.*Not affected
7.2.1 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.