CVE-2026-80590 (GCVE-0-2026-80590)
Vulnerability from cvelistv5 – Published: 2026-08-28 06:35 – Updated: 2026-10-16 19:26
VLAI
EPSS
VEX
Title
inet: frags: strip GSO state from fragments before reassembly
Summary
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: strip GSO state from fragments before reassembly
A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark
an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.
inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first
fragment's skb as the head of the reassembled datagram, including its
shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments
on frag_list with whatever linear/paged layout they arrived with.
After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the
reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and
the next software segmentation point - udp_rcv_segment() on local
delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow
path - hands it to skb_segment(). skb_segment()'s frag_list walk
assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to
a tap by an unprivileged user in its own userns are enough:
kernel BUG at net/core/skbuff.c:4899!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2
RIP: 0010:skb_segment+0x20ca/0x48b0
Call Trace:
<TASK>
__udp_gso_segment+0x29a/0x27d0
udp4_ufo_fragment+0x458/0x6c0
inet_gso_segment+0x429/0x1340
skb_mac_gso_segment+0x233/0x4f0
__skb_gso_segment+0x308/0x660
udp_queue_rcv_skb+0x440/0xad0
udp_unicast_rcv_skb+0xc7/0x2c0
udp_rcv+0x16ce/0x2260
ip_protocol_deliver_rcu+0x197/0x2d0
ip_local_deliver+0x430/0x690
ip_rcv+0x16f/0x1f0
__netif_receive_skb_one_core+0x15e/0x1c0
__netif_receive_skb+0x1e/0x110
netif_receive_skb+0xf6/0x5c0
tun_rx_batched.isra.0+0x3ab/0x790
tun_get_user+0x17c3/0x3550
tun_chr_write_iter+0xba/0x1b0
vfs_write+0x646/0x1130
</TASK>
Kernel panic - not syncing: Fatal exception in interrupt
This runs with BH disabled, so it is a panic rather than an oops. The
same is reachable with CAP_NET_RAW in a netns where a defrag point
precedes a GSO point, and from a guest whose VMM forwards
virtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by
commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting
gso_size mangled skb having linear-headed frag_list") and by
commit 9e4b7a99a03a ("net: gso: fix panic on frag_list with mixed head
alloc types") do not cover it: page-backed heads skip them, and kmalloc
heads skip them when gso_size == skb_headlen(head), which the sender
controls.
An skb entering a frag queue is an IP fragment by definition and
cannot legitimately carry GSO state: GRO does not merge fragments and
the stack segments before it fragments, so only untrusted sources are
affected. This has been reachable since
commit f43798c27684 ("tun: Allow GSO using virtio_net_hdr"), the first
path that let userspace attach GSO metadata to an IP fragment. Reset
the GSO fields of every fragment as it is queued, in
inet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and
6lowpan reassembly share; then neither the head nor the frag_list
members of the reassembled skb carry them (the members matter too:
the ip_do_fragment()/ip6_fragment() fast paths send them out as they
are). The head may remain CHECKSUM_PARTIAL; that is already accepted
on receive and resolved by skb_checksum_help() in
ip_do_fragment()/ip6_fragment() on forward.
Tested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer
above, two further IPv4 frag_list geometries that reach
BUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6
fragment-header variant (udp6_ufo_fragment()) each panic the unpatched
kernel; with this patch all four datagrams are delivered intact and
nothing is logged.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:18 UTC
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
f43798c27684ab925adde7d8acc34c78c6e50df8 , < cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee
(git)
Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < 29dda278a5ed272f2230ff4eaa23cf403107bba0 (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < 14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234 (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < 3edf721bb4b99d272c336631b44e3d8ff9a4f31b (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < dec2edb7aaf12a8878b3a03172ea8fc277b8eaad (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < 69b73b74d9eb45f5560a8fe4fa406ada580e1340 (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < da857e448322a2e871ce3ecc2900027041160d43 (git) Affected: f43798c27684ab925adde7d8acc34c78c6e50df8 , < d5dc1e69fd7258ea605c9952e5d5947539159ae3 (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.27
Unaffected: 0 , < 2.6.27 (semver) Unaffected: 5.10.268 , ≤ 5.10.* (semver) Unaffected: 5.15.219 , ≤ 5.15.* (semver) Unaffected: 6.1.186 , ≤ 6.1.* (semver) Unaffected: 6.6.155 , ≤ 6.6.* (semver) Unaffected: 6.12.107 , ≤ 6.12.* (semver) Unaffected: 6.18.48 , ≤ 6.18.* (semver) Unaffected: 7.1.12 , ≤ 7.1.* (semver) Unaffected: 7.2.2 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:18:13.413771Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:29.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "29dda278a5ed272f2230ff4eaa23cf403107bba0",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "3edf721bb4b99d272c336631b44e3d8ff9a4f31b",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "dec2edb7aaf12a8878b3a03172ea8fc277b8eaad",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "69b73b74d9eb45f5560a8fe4fa406ada580e1340",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "da857e448322a2e871ce3ecc2900027041160d43",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "d5dc1e69fd7258ea605c9952e5d5947539159ae3",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.268",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.219",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.186",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.155",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.107",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.48",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.268",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.219",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.186",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.155",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.107",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.48",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.12",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.2",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment\u0027s skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()\u0027s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \u003cTASK\u003e\n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e= nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious cloud VM guest injects virtio_net_hdr-marked IPv4/IPv6 fragments through virtio-net/vhost-tap into the host ip_rcv() path; the same inet_frag reassembly and skb_segment() crash also fires on validate_xmit_skb()/ip_finish_output_gso() when such skbs traverse forwarding.\nAC:L - The attacker fully controls virtio_net_hdr gso_type/gso_size and fragment geometry; the commit reproduces a host panic from two tap writes with no races, timing, or uncontrollable memory layout required.\nPR:N - On typical KVM/QEMU tap-backed virtio-net deployments a tenant VM needs no host account or capability; exploitation uses only the pre-provisioned virtual NIC, not init-namespace root or CAP_NET_ADMIN on the host.\nUI:N - Packet injection, ip_defrag reassembly, and GSO segmentation run automatically in softirq once crafted virtio fragments are sent; no victim mount, click, or other cooperative action is required.\nS:C - A guest VM tenant can panic the host kernel by crossing the hypervisor virtio/tap boundary, impacting resources outside the guest security authority even though the demonstrated primitive is denial of service rather than full escape.\nC:N - Impact is an intentional BUG_ON in skb_segment() frag_list handling; there is no demonstrated out-of-bounds read, use-after-free, or other information-disclosure primitive before the assertion aborts.\nI:N - The failure aborts in skb_segment() before any out-of-bounds write, page-desc conversion, or control-flow hijack; attacker-controlled metadata only reaches a defensive assertion, not a memory modification primitive.\nA:H - Triggering skb_segment() BUG_ON from tun_rx/tun_get_user runs with BH disabled and causes a fatal kernel panic, fully and repeatedly denying availability of the affected host until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T06:12:21.989Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee"
},
{
"url": "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0"
},
{
"url": "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234"
},
{
"url": "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b"
},
{
"url": "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad"
},
{
"url": "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace"
},
{
"url": "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340"
},
{
"url": "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43"
},
{
"url": "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3"
}
],
"title": "inet: frags: strip GSO state from fragments before reassembly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80590",
"datePublished": "2026-08-28T06:35:12.516Z",
"dateReserved": "2026-08-26T14:34:25.770Z",
"dateUpdated": "2026-10-16T19:26:29.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-80590",
"date": "2026-10-16",
"epss": "0.00578",
"percentile": "0.46416"
},
"microsoft_vex": {
"current_release_date": "2026-09-24T01:46:03.000Z",
"cve": "CVE-2026-80590",
"id": "msrc_CVE-2026-80590",
"initial_release_date": "2026-08-29T01:05:17.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "inet: frags: strip GSO state from fragments before reassembly",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80590.json",
"version": "4"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "29dda278a5ed272f2230ff4eaa23cf403107bba0",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "3edf721bb4b99d272c336631b44e3d8ff9a4f31b",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "dec2edb7aaf12a8878b3a03172ea8fc277b8eaad",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "69b73b74d9eb45f5560a8fe4fa406ada580e1340",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "da857e448322a2e871ce3ecc2900027041160d43",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "d5dc1e69fd7258ea605c9952e5d5947539159ae3",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.268",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.219",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.186",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.155",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.107",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.48",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment\u0027s skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()\u0027s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \u003cTASK\u003e\n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e= nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged."
}
],
"id": "CVE-2026-80590",
"lastModified": "2026-10-16T20:18:02.410",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-80590",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:18:13.413771Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-28T08:16:42.517",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-03T18:41:24+00:00",
"cve": "CVE-2026-80590",
"id": "CVE-2026-80590",
"initial_release_date": "2026-08-28T00:00:00+00:00",
"product_status:known_affected": "260",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: inet: frags: strip GSO state from fragments before reassembly",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80590.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:18:13.413771Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:18:14.027Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "29dda278a5ed272f2230ff4eaa23cf403107bba0",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "3edf721bb4b99d272c336631b44e3d8ff9a4f31b",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "dec2edb7aaf12a8878b3a03172ea8fc277b8eaad",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "69b73b74d9eb45f5560a8fe4fa406ada580e1340",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "da857e448322a2e871ce3ecc2900027041160d43",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "d5dc1e69fd7258ea605c9952e5d5947539159ae3",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.268",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.219",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.186",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.155",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.107",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.48",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.268",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.219",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.186",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.155",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.107",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.48",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.12",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.2",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment\u0027s skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()\u0027s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \u003cTASK\u003e\n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e= nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious cloud VM guest injects virtio_net_hdr-marked IPv4/IPv6 fragments through virtio-net/vhost-tap into the host ip_rcv() path; the same inet_frag reassembly and skb_segment() crash also fires on validate_xmit_skb()/ip_finish_output_gso() when such skbs traverse forwarding.\nAC:L - The attacker fully controls virtio_net_hdr gso_type/gso_size and fragment geometry; the commit reproduces a host panic from two tap writes with no races, timing, or uncontrollable memory layout required.\nPR:N - On typical KVM/QEMU tap-backed virtio-net deployments a tenant VM needs no host account or capability; exploitation uses only the pre-provisioned virtual NIC, not init-namespace root or CAP_NET_ADMIN on the host.\nUI:N - Packet injection, ip_defrag reassembly, and GSO segmentation run automatically in softirq once crafted virtio fragments are sent; no victim mount, click, or other cooperative action is required.\nS:C - A guest VM tenant can panic the host kernel by crossing the hypervisor virtio/tap boundary, impacting resources outside the guest security authority even though the demonstrated primitive is denial of service rather than full escape.\nC:N - Impact is an intentional BUG_ON in skb_segment() frag_list handling; there is no demonstrated out-of-bounds read, use-after-free, or other information-disclosure primitive before the assertion aborts.\nI:N - The failure aborts in skb_segment() before any out-of-bounds write, page-desc conversion, or control-flow hijack; attacker-controlled metadata only reaches a defensive assertion, not a memory modification primitive.\nA:H - Triggering skb_segment() BUG_ON from tun_rx/tun_get_user runs with BH disabled and causes a fatal kernel panic, fully and repeatedly denying availability of the affected host until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T06:12:21.989Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee"
},
{
"url": "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0"
},
{
"url": "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234"
},
{
"url": "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b"
},
{
"url": "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad"
},
{
"url": "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace"
},
{
"url": "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340"
},
{
"url": "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43"
},
{
"url": "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3"
}
],
"title": "inet: frags: strip GSO state from fragments before reassembly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80590",
"datePublished": "2026-08-28T06:35:12.516Z",
"dateReserved": "2026-08-26T14:34:25.770Z",
"dateUpdated": "2026-10-16T19:26:29.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.