Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98556— gve: DQO: reject TSO packets with an out of range MSS

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： gve: DQO：拒绝 MSS 超出范围的 TSO 数据包 函数指出该设备要求 MSS（最大分段大小）必须小于或等于 9728 字节，但该函数并未强制执行此限制，而是假设由 Hypervisor 强制执行的 9K MTU 以及 TSO 大小的 64KB 上限已足够安全。 然而，这一假设对于非本地生成的数据包并不成立。位于 TAP 设备后方的虚拟机，或任何使用数据包套接字（packet socket）的用户，均可在 中提供任意值的 。二层转发路径不会检查 GSO 数据包的

AI Predicted 5.9 Difficulty: Moderate EPSS 0.20% · P9

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux a57e5de476be0b4b7f42beb6a21c19ad9c577aa3< 2dc3ae3942e151fef254b7bbb65c832192ad2069 affected
a57e5de476be0b4b7f42beb6a21c19ad9c577aa3< c517e8755960c8c6335ebf7dae6c95c43e5fb085 affected
a57e5de476be0b4b7f42beb6a21c19ad9c577aa3< 296c83b5ccc808c080865eb20fd7a477b0355bb7 affected
5.14 affected
< 5.14 unaffected
6.18.55≤ 6.18.* unaffected
7.2.9≤ 7.2.* unaffected
7.3≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98556

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
gve: DQO: reject TSO packets with an out of range MSS
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gve_prep_tso() notes that the device requires the MSS to be <= 9728, but does not enforce it, assuming the 9K MTU enforced by the hypervisor and the 64KB limit on TSO sizes are enough. This does not hold for packets that were not generated locally. A guest behind a tap, or any packet socket user, can provide an arbitrary gso_size in virtio_net_hdr. Layer 2 forwarding does not check the MTU for GSO packets (is_skb_forwardable()), and gso_features_check() only bounds skb->len and gso_segs, never gso_size. Such a packet reaches gve_tx_fill_tso_ctx_desc(), which puts gso_size into the mss field of the TSO context descriptor. This field is 14 bits wide, so a gso_size of 16384 is silently turned into an MSS of zero. Drop these packets from gve_prep_tso(), and make sure that gve_features_check_dqo() leaves their GSO bits alone: skb_segment() splits at gso_size regardless of the MTU, so falling back to software segmentation would give the device non TSO packets bigger than the 9728 bytes it supports. Note that the device can still be given oversized non TSO packets when the stack segments in software for other reasons, for instance after TSO has been disabled with ethtool. This is a generic issue, because the MTU check is skipped for GSO packets in the forwarding path, and is addressed separately.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a57e5de476be0b4b7f42beb6a21c19ad9c577aa3 ~ 2dc3ae3942e151fef254b7bbb65c832192ad2069 -
Linux Linux 5.14 -

II. Public POCs for CVE-2026-98556

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98556

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98556 (2)

Same Patch Batch · Linux · 2026-10-18 · 435 CVEs total

CVE-2026-98720 KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
CVE-2026-98733 Bluetooth: hci_core: Serialize fragmented ISO packet queueing
CVE-2026-98732 Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
CVE-2026-98731 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
CVE-2026-98730 Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
CVE-2026-98729 x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random()
CVE-2026-98727 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks
CVE-2026-98725 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments
CVE-2026-98723 nvmet: copy the hostid into the ctrl before creating PR pc_refs
CVE-2026-98722 mtd: block2mtd: Fix divide error when erase_size is zero
CVE-2026-98721 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch
CVE-2026-98712 KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device
CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove
CVE-2026-98713 KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
CVE-2026-98707 wifi: mac80211: shut down RX BA session timer on teardown

Showing top 20 of 435 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98556

No comments yet

Leave a comment