REDHAT-BUG-2492270: High severity Linux Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdiscpktlensegsinit()
Most ndostartxmit() methods expects headers of gso packets to be already in skb->head.
net/core/tso.c users are particularly at risk, because tsobuildhdr() does a memcpy(hdr, skb->data, hdrlen);
qdiscpktlensegsinit() already does a dissection of gso packets.
Use pskbmaypull() instead of skbheaderpointer() to make sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKBDROPREASONSKBBADGSO dropreason.
Affected Software
Event History
Frequently Asked Questions
Which systems are most exposed to this issue?
Systems using Linux kernel network drivers whose ndo_start_xmit() implementations expect GSO packet headers to be present in skb->head are exposed. Users of net/core/tso.c are identified as particularly at risk.
What must an attacker be able to do to trigger the issue?
An attacker must be able to feed malicious GSO packets into the affected networking path. The vulnerable behavior involves packet headers not being pulled into the packet head before transmit processing.
What remediation information is available?
The issue is resolved by ensuring headers are pulled with pskb_may_pull() during qdisc_pkt_len_segs_init() processing and by dropping invalid GSO packets with the SKB_DROP_REASON_SKB_BAD_GSO reason. Red Hat errata references RHSA-2026:65334 and RHSA-2026:66324 are provided.