CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix double aggregation of flush-marked skbs

Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skbgroreceive(), but skbgroreceivelist() lacks the same validation.

As a result, packets marked with NAPIGROCB(skb)->flush may still be re-aggregated.

This allows already-GRO'd packets with existing fraglist to be re-aggregated into a new GRO session, corrupting the fraglist chain structure. When skbsegment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic.

Scenario (Tethering/Device forwarding): 1. Driver: Generated aggregated packet P1 via LRO with fraglist 2. Dev A: Receives aggregated fraglist packet and flush flag set 3. Dev A: Re-enters GRO, skbgroreceivelist() is called 4. Missing flush check allows re-aggregation despite flush flag 5. Fraglist chain becomes corrupted (loops or dangling refs) 6. Dev B: TX path calls skbsegment(), crashes on corrupted fraglist

Root cause in skbsegment(): The check at line ~4891: if (hsize <= 0 && i >= nfrags && skbheadlen(listskb) && (skbheadlen(listskb) == len || sg)) {

When fraglist is corrupted by double aggregation, when listskb is a NULL pointer from skb->next, skbheadlen(listskb) dereference NULL/corrupted pointers occurs.

Call Trace: skbheadlen(NULL skb) skbsegment tcpgsosegment tcp4gsosegment inetgsosegment skbmacgsosegment skbgsosegment skbgsosegment validatexmitskb validatexmitskblist schdirectxmit qdiscrestart qdiscrun qdiscrun nettxaction

Fix: Add NAPIGROCB(skb)->flush validation to the early-return check in skbgroreceivelist(), matching the defensive programming pattern of skbgroreceive().