Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80590— inet: frags: strip GSO state from fragments before reassembly

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该 Linux 内核漏洞描述信息的中文翻译： 在 Linux 内核中，以下漏洞已得到修复： inet: frags: 在重组前从 IP 分片中剥离 GSO 状态 问题描述： （用于 tun/tap 或带有 的 ）可以将 IPv4 或 IPv6 分片标记为 GSO（通用分段卸载）；然而没有任何机制将 与 （分片偏移量）关联起来。 / 会保留第一个分片的 skb 作为重组后数据报的头部（包括其 / / ），并将其余分片按照其到达时的线性/分页布局链接到 中。 在 （如 、 等）之后，重组后的 skb 仍然声称自己

CVSS 8.6 · High EPSS 0.59% · P46

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux f43798c27684ab925adde7d8acc34c78c6e50df8< cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee affected
f43798c27684ab925adde7d8acc34c78c6e50df8< 29dda278a5ed272f2230ff4eaa23cf403107bba0 affected
f43798c27684ab925adde7d8acc34c78c6e50df8< 14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234 affected
f43798c27684ab925adde7d8acc34c78c6e50df8< 3edf721bb4b99d272c336631b44e3d8ff9a4f31b affected
f43798c27684ab925adde7d8acc34c78c6e50df8< dec2edb7aaf12a8878b3a03172ea8fc277b8eaad affected
f43798c27684ab925adde7d8acc34c78c6e50df8< c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace affected
f43798c27684ab925adde7d8acc34c78c6e50df8< 69b73b74d9eb45f5560a8fe4fa406ada580e1340 affected
f43798c27684ab925adde7d8acc34c78c6e50df8< da857e448322a2e871ce3ecc2900027041160d43 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80590

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
inet: frags: strip GSO state from fragments before reassembly
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off. inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first fragment's skb as the head of the reassembled datagram, including its shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments on frag_list with whatever linear/paged layout they arrived with. After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and the next software segmentation point - udp_rcv_segment() on local delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow path - hands it to skb_segment(). skb_segment()'s frag_list walk assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to a tap by an unprivileged user in its own userns are enough: kernel BUG at net/core/skbuff.c:4899! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2 RIP: 0010:skb_segment+0x20ca/0x48b0 Call Trace: <TASK> __udp_gso_segment+0x29a/0x27d0 udp4_ufo_fragment+0x458/0x6c0 inet_gso_segment+0x429/0x1340 skb_mac_gso_segment+0x233/0x4f0 __skb_gso_segment+0x308/0x660 udp_queue_rcv_skb+0x440/0xad0 udp_unicast_rcv_skb+0xc7/0x2c0 udp_rcv+0x16ce/0x2260 ip_protocol_deliver_rcu+0x197/0x2d0 ip_local_deliver+0x430/0x690 ip_rcv+0x16f/0x1f0 __netif_receive_skb_one_core+0x15e/0x1c0 __netif_receive_skb+0x1e/0x110 netif_receive_skb+0xf6/0x5c0 tun_rx_batched.isra.0+0x3ab/0x790 tun_get_user+0x17c3/0x3550 tun_chr_write_iter+0xba/0x1b0 vfs_write+0x646/0x1130 </TASK> Kernel panic - not syncing: Fatal exception in interrupt This runs with BH disabled, so it is a panic rather than an oops. The same is reachable with CAP_NET_RAW in a netns where a defrag point precedes a GSO point, and from a guest whose VMM forwards virtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list") and by commit 9e4b7a99a03a ("net: gso: fix panic on frag_list with mixed head alloc types") do not cover it: page-backed heads skip them, and kmalloc heads skip them when gso_size == skb_headlen(head), which the sender controls. An skb entering a frag queue is an IP fragment by definition and cannot legitimately carry GSO state: GRO does not merge fragments and the stack segments before it fragments, so only untrusted sources are affected. This has been reachable since commit f43798c27684 ("tun: Allow GSO using virtio_net_hdr"), the first path that let userspace attach GSO metadata to an IP fragment. Reset the GSO fields of every fragment as it is queued, in inet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and 6lowpan reassembly share; then neither the head nor the frag_list members of the reassembled skb carry them (the members matter too: the ip_do_fragment()/ip6_fragment() fast paths send them out as they are). The head may remain CHECKSUM_PARTIAL; that is already accepted on receive and resolved by skb_checksum_help() in ip_do_fragment()/ip6_fragment() on forward. Tested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer above, two further IPv4 frag_list geometries that reach BUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6 fragment-header variant (udp6_ufo_fragment()) each panic the unpatched kernel; with this patch all four datagrams are delivered intact and nothing is logged.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux f43798c27684ab925adde7d8acc34c78c6e50df8 ~ cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee -
Linux Linux 2.6.27 -

II. Public POCs for CVE-2026-80590

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80590

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80590 (8)

Other References for CVE-2026-80590 (1)

Same Patch Batch · Linux · 2026-08-28 · 135 CVEs total

CVE-2026-80674 9.8 CRITICAL ntfs: validate resident attribute lists and harden the validator
CVE-2026-80630 9.8 CRITICAL net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restorin
CVE-2026-80617 9.8 CRITICAL net: airoha: fix foe_check_time allocation size
CVE-2026-80612 9.8 CRITICAL net: lwtunnel: Drop skb metadata before LWT encapsulation
CVE-2026-80634 9.8 CRITICAL netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
CVE-2026-80609 9.8 CRITICAL qede: fix out-of-bounds check for cqe->len_list[]
CVE-2026-80694 9.8 CRITICAL net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
CVE-2026-80668 9.8 CRITICAL netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
CVE-2026-80714 9.8 CRITICAL ipvs: do not propagate one-packet flag to synced conns
CVE-2026-80600 9.8 CRITICAL batman-adv: dat: acquire ARP hw source only after skb realloc
CVE-2026-80673 9.8 CRITICAL ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
CVE-2026-80681 9.8 CRITICAL vxlan: re-fetch eth header after route_shortcircuit()
CVE-2026-80684 9.3 CRITICAL KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
CVE-2026-80671 9.3 CRITICAL perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
CVE-2026-80693 9.3 CRITICAL idpf: bound interrupt-vector register fill to the allocated array
CVE-2026-80603 9.1 CRITICAL netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
CVE-2026-80670 9.1 CRITICAL perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
CVE-2026-80633 8.8 HIGH iommufd: Take dma_resv lock before dma_buf_unpin() in release path
CVE-2026-80638 8.8 HIGH ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
CVE-2026-80722 8.8 HIGH wifi: mac80211: validate individual TWT params before driver setup

Showing top 20 of 135 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80590

No comments yet

Leave a comment