CVE-2026-90063

virtio-net: Ensure that TCP packets don't overflow gso_segs

N/A

Published: September 17, 2026 at 04:05 PM UTC

Updated: October 19, 2026 at 09:18 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gso_segs The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size. Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

90%

4.14.187 4.19.131 5.4.46 5.6.18 5.76c83456601e65a6dd371ddf595510183d198e9b17c6d2ecbda83150b2036a2b36b21381ad4667762b3ebd9830c6026c98f03f7047c9d608573773f13b96fb681ca789629b8ba3da99ca3b2e6fa807f0abfbaf151efe491e30697e21c8b7ae1b615480873

Vendor states this is fixed in 0e5ed3b98d1d8d251acfdccfeaa607453ad12954 (fixed)

Vendor states this is fixed in 29bd12c7c5f9d6cf855b87bace18f71e9607f9e8 (fixed)

Vendor states this is fixed in 339f47ae04dcc6b5a730dd6bc70dddc8937c3260 (fixed)

Vendor states this is fixed in 75c271c48f483af678e514734e10b2452410e08c (fixed)

Vendor states this is fixed in 8f6667a081887c2b59c6f3dd86c1789ada563762 (fixed)

Vendor states this is fixed in c27c449d455aafd9018a3cbab150f1c42c87923f (fixed)

Vendor states this is fixed in d3d111fe809773edbb4ae121e36253b7d683509a (fixed)

Affected range stops below 4.15, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.20, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.15.221 (unaffected)

Affected range stops below 5.5, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 5.7 (unaffected)