Riskcovery

CVE-2026-90063

virtio-net: Ensure that TCP packets don't overflow gso_segs

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 11, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: Ensure that TCP packets don't overflow gso_segs

The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size.

Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7c6d2ecbda83150b2036a2b36b21381ad4667762 to before d3d111fe809773edbb4ae121e36253b7d683509aAffected
  • 7c6d2ecbda83150b2036a2b36b21381ad4667762 to before 8f6667a081887c2b59c6f3dd86c1789ada563762Affected
  • 7c6d2ecbda83150b2036a2b36b21381ad4667762 to before 339f47ae04dcc6b5a730dd6bc70dddc8937c3260Affected
  • 7c6d2ecbda83150b2036a2b36b21381ad4667762 to before 29bd12c7c5f9d6cf855b87bace18f71e9607f9e8Affected
  • 7c6d2ecbda83150b2036a2b36b21381ad4667762 to before 0e5ed3b98d1d8d251acfdccfeaa607453ad12954Affected
  • 7c6d2ecbda83150b2036a2b36b21381ad4667762 to before 75c271c48f483af678e514734e10b2452410e08cAffected
  • 7c6d2ecbda83150b2036a2b36b21381ad4667762 to before c27c449d455aafd9018a3cbab150f1c42c87923fAffected
  • bfbaf151efe491e30697e21c8b7ae1b615480873Affected
  • 6c83456601e65a6dd371ddf595510183d198e9b1Affected
  • b3ebd9830c6026c98f03f7047c9d608573773f13Affected
  • b96fb681ca789629b8ba3da99ca3b2e6fa807f0aAffected
  • 4.14.187 to before 4.15Affected
  • 4.19.131 to before 4.20Affected
  • 5.4.46 to before 5.5Affected
  • 5.6.18 to before 5.7Affected
LinuxLinux
  • 5.7Affected
  • before 5.7Not affected
  • 5.15.221 through 5.15.*Not affected
  • 6.1.188 through 6.1.*Not affected
  • 6.6.157 through 6.6.*Not affected
  • 6.12.110 through 6.12.*Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.