CVE-2026-90063: virtio-net: Ensure that TCP packets don't overflow gso_segs
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: Ensure that TCP packets don't overflow gsosegs
The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSEGS = 8 65535. When the user crafts a packet with gsosize < 8, there is a risk for partial GSO to overflow the 16-bit gsosegs field when dividing the SKB length by gsosize.
Adjust gsosize of TCP packets to be at least TCPMINGSOSIZE = 8. Keep gsosize of UDP GSO packets, as gsosize=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure TCP packet GSO uses gso_size values at least TCP_MIN_GSO_SIZE = 8 to prevent overflow of the 16-bit gso_segs field when dividing SKB length by gso_size.
Linux kernel (AF_PACKET / PACKET_VNET_HDR) gso_size = >= 8 - Compensating control
Keep PACKET_VNET_HDR socket behavior even when smaller than TCP_MIN_GSO_SIZE = 8, so that crafted packets cannot trigger partial GSO issues that could overflow gso_segs (as described for gso_size < 8).
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The attacker needs the ability to craft packets through an AF_PACKET socket using the PACKET_VNET_HDR option and control the packet's gso_size value. The issue is triggered by TCP packets with a gso_size smaller than 8.
Are UDP GSO packets affected by the gso_size restriction?
No. The fix applies the minimum gso_size adjustment to TCP packets only; UDP GSO packets retain their supplied gso_size because a value of 1 is valid for UDP GSO.
What should be checked to determine whether systems are exposed?
Check whether local users or workloads can create AF_PACKET PACKET_VNET_HDR sockets and inject crafted TCP packets with very small GSO sizes. The vulnerable condition involves a TCP gso_size below TCP_MIN_GSO_SIZE, which is 8.