CVE-2026-98556: gve: DQO: reject TSO packets with an out of range MSS
gve: DQO: reject TSO packets with an out of range MSS
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the gve DQO transmit path, reject/drop TSO packets whose MSS (gso_size) exceeds 9728 bytes in gve_prep_tso(), and ensure gve_features_check_dqo() leaves their GSO bits unchanged so they are not software-segmented into oversized non-TSO packets.
Event History
Frequently Asked Questions
Who can supply the malformed packets?
A guest behind a tap device or a local packet socket user can provide a virtio_net_hdr with an arbitrary gso_size. Packets generated locally are not the only relevant source.
Does enforcing a 9K MTU prevent this condition?
No. Layer 2 forwarding does not check the MTU for GSO packets, and the existing GSO checks bound packet length and segment count but not gso_size.
What happens when an oversized MSS reaches the device descriptor?
The gso_size is written to a 14-bit MSS field in the TSO context descriptor. For example, a gso_size of 16384 is truncated to an MSS value of zero.
Can software segmentation safely be used as a fallback for these packets?
No. skb_segment() segments based on gso_size regardless of the MTU, which could produce non-TSO packets larger than the device's 9728-byte limit. The resolved behavior is to drop the out-of-range TSO packets.