CVE-2026-53091: net: pull headers in qdisc_pkt_len_segs_init()
In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdiscpktlensegsinit()
Most ndostartxmit() methods expects headers of gso packets to be already in skb->head.
net/core/tso.c users are particularly at risk, because tsobuildhdr() does a memcpy(hdr, skb->data, hdrlen);
qdiscpktlensegsinit() already does a dissection of gso packets.
Use pskbmaypull() instead of skbheaderpointer() to make sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKBDROPREASONSKBBADGSO dropreason.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is rated as locally exploitable and requires low privileges. No user interaction is required.
What impact could successful exploitation have?
The provided severity vector indicates high confidentiality impact and high availability impact, with scope changed. Integrity impact is rated as none.
Which networking paths are most relevant when assessing exposure?
Systems handling GSO packets through qdisc and ndo_start_xmit() paths are relevant. Users of net/core/tso.c are identified as particularly at risk because tso_build_hdr() copies packet headers from skb data.
How can the issue be remediated?
A patch is available. The supplied stable kernel commit references and the listed Red Hat errata can be used to identify the applicable fix for the deployed kernel.