Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80793— ipv4: reject undersized MTUs in ip_do_fragment()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于ip_do_fragment()函数处理小于IPv4头长度加8的有效MTU时，将分片负载长度向下舍入为零，导致持续分配并传输仅含头部的分片，可能触发内核软锁，造成拒绝服务。

AI Predicted 5.0 Difficulty: Moderate EPSS 0.19% · P9

Possible ATT&CK Techniques 1 AI

T1029 · Scheduled Transfer

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a716a64a4ba68cd46f2745fba2b1099fe8e0aa59 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 515b6816ba0c12d8415c88e5f41e6ec029e35cfa affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 74ce7389f8f562d39015f59a00ef7ad6acd37803 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< b0ea911453ce7210e8200a07a94d2458bd1e6430 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 36e0741833bd823866f8cb9f112f37cea1a70b60 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< d9d1a676b033acabf8e5645f730486d1f8204a3f affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 3556beb8ca86677af2aca5bfbed6f8e790fccc83 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< c8a74adccaf028223054633b532593101dfcc581 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80793

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv4: reject undersized MTUs in ip_do_fragment()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于ip_do_fragment()函数处理小于IPv4头长度加8的有效MTU时，将分片负载长度向下舍入为零，导致持续分配并传输仅含头部的分片，可能触发内核软锁，造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ a716a64a4ba68cd46f2745fba2b1099fe8e0aa59 -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2026-80793

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80793

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80793 (7)

Vendor Advisories for CVE-2026-80793 (1)

Other References for CVE-2026-80793 (1)

Same Patch Batch · Linux · 2026-09-04 · 156 CVEs total

CVE-2026-80865 bpf: Add missing access_ok call to copy_user_syms
CVE-2026-80856 fuse: fix invalidate lock leak on setattr writeback failure
CVE-2026-80857 fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
CVE-2026-80858 fuse: publish io-uring queues with release semantics
CVE-2026-80859 fuse: fix missing barrier when checking io-uring readiness
CVE-2026-80860 fuse: fix race between interrupt and resend
CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible
CVE-2026-80862 nvme-tcp: fix usage of page_frag_cache
CVE-2026-80863 RDMA/rxe: Fix OOB in free_rd_atomic_resources()
CVE-2026-80864 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
CVE-2026-80874 arm64: dts: renesas: ironhide: Describe inline ECC carveouts
CVE-2026-80873 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
CVE-2026-80872 ALSA: hda/tas2781: Cancel async firmware request at unbind
CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface
CVE-2026-80868 ntfs3: Allocate iomap inline_data using alloc_page
CVE-2026-80866 tipc: avoid busy looping in tipc_exit_net()
CVE-2026-80867 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
CVE-2026-80855 fuse: fix invalidate lock leak on open O_TRUNC DAX failure
CVE-2026-80869 ntfs: bound the attribute-list entry in ntfs_read_inode_mount()

Showing top 20 of 156 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80793

No comments yet

Leave a comment