CVE-2026-100236: Dpdk: dpdk: heap out-of-bounds read/write in gso header copy
A flaw was found in DPDK lib/gso. hdrsegmentinit() copies pkthdroffset bytes from the first mbuf segment into a newly allocated header mbuf using rtememcpy without checking that the source first segment is long enough or that the destination mbuf has enough tailroom. pkthdroffset is taken from mbuf l2/l3/l4 (and outer) length fields, which applications commonly populate from packet headers including IP IHL and TCP data offset. A related uint16t subtraction (gsosize - hdroffset) underflows when the header is larger than gsosize. An application that runs software GSO on packets from an untrusted source (for example a guest via vhost, or scatter RX) can therefore read or write past mbuf bounds.
Other sources
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.
— MITRE
Dpdk: dpdk: heap out-of-bounds read/write in gso header copy
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.11.8-1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments that run DPDK software GSO on packets from an untrusted source are exposed. Examples given include guest traffic received through vhost and packets received as scattered RX buffers.
What does an attacker need to trigger the flaw?
An attacker needs to supply a packet that is processed by software GSO. The packet's header-length metadata, including values derived from IP IHL and TCP data offset, can cause the header copy to exceed source or destination mbuf bounds; a header larger than the configured GSO segment size can also underflow the payload-size calculation.
Are packets safe when their headers span multiple mbuf segments?
No. The vulnerable header copy assumes the first mbuf segment contains pkt_hdr_offset bytes, but does not verify that assumption. A packet whose required header bytes extend beyond the first segment can cause an out-of-bounds source read.
What temporary mitigation is supported by the available information?
Avoid running software GSO on traffic from untrusted sources until a fix is available. In particular, review paths handling guest vhost traffic and scatter RX packets, since these are identified as example attack paths.