Vulnerability-Lookup

GHSA-WJRJ-HVQV-FW2V

Vulnerability from github – Published: 2026-03-18 18:31 – Updated: 2026-03-18 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix outer network offset

The udp GRO complete stage assumes that all the packets inserted the RX have the encapsulation flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup.

Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner instead of outer) to compute the outer UDP header pseudo checksum, leading to csum validation errors later on in packet processing.

Address the issue always clearing the encapsulation flag at GRO completion time. Such flag will be set again as needed for encapsulated packets by udp_gro_complete().

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-23254"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-18T18:16:23Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix outer network offset\n\nThe udp GRO complete stage assumes that all the packets inserted the RX\nhave the `encapsulation` flag zeroed. Such assumption is not true, as a\nfew H/W NICs can set such flag when H/W offloading the checksum for\nan UDP encapsulated traffic, the tun driver can inject GSO packets with\nUDP encapsulation and the problematic layout can also be created via\na veth based setup.\n\nDue to the above, in the problematic scenarios, udp4_gro_complete() uses\nthe wrong network offset (inner instead of outer) to compute the outer\nUDP header pseudo checksum, leading to csum validation errors later on\nin packet processing.\n\nAddress the issue always clearing the encapsulation flag at GRO completion\ntime. Such flag will be set again as needed for encapsulated packets by\nudp_gro_complete().",
  "id": "GHSA-wjrj-hvqv-fw2v",
  "modified": "2026-03-18T18:31:17Z",
  "published": "2026-03-18T18:31:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23254"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2e5edb69e5d0e23ef248c56fc977039268c77a7b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5c2c3c38be396257a6a2e55bd601a12bb9781507"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9d40a85138568696387ef04cd004c64612a70874"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b83557bc6f560433fe5d727e241069f8db5ba709"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-23254 (GCVE-0-2026-23254)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:41 – Updated: 2026-03-18 17:41

Title

net: gro: fix outer network offset

Summary

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix outer network offset The udp GRO complete stage assumes that all the packets inserted the RX have the `encapsulation` flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup. Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner instead of outer) to compute the outer UDP header pseudo checksum, leading to csum validation errors later on in packet processing. Address the issue always clearing the encapsulation flag at GRO completion time. Such flag will be set again as needed for encapsulated packets by udp_gro_complete().

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/9d40a851385686963…
	https://git.kernel.org/stable/c/b83557bc6f560433f…
	https://git.kernel.org/stable/c/2e5edb69e5d0e23ef…
	https://git.kernel.org/stable/c/5c2c3c38be396257a…

Impacted products

Vendor

Product

Version

Linux

Affected: af276a5ac8e938c8b058e3e124073cc1e322d98b , < 9d40a85138568696387ef04cd004c64612a70874 (git)
Affected: 5ef31ea5d053a8f493a772ebad3f3ce82c35d845 , < b83557bc6f560433fe5d727e241069f8db5ba709 (git)
Affected: 5ef31ea5d053a8f493a772ebad3f3ce82c35d845 , < 2e5edb69e5d0e23ef248c56fc977039268c77a7b (git)
Affected: 5ef31ea5d053a8f493a772ebad3f3ce82c35d845 , < 5c2c3c38be396257a6a2e55bd601a12bb9781507 (git)
Affected: dbd9466d323a72e22efe09151253d195d36d3bf6 (git)

Linux

Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.6.124 , ≤ 6.6.* (semver)
Unaffected: 6.12.70 , ≤ 6.12.* (semver)
Unaffected: 6.18.10 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d40a85138568696387ef04cd004c64612a70874",
              "status": "affected",
              "version": "af276a5ac8e938c8b058e3e124073cc1e322d98b",
              "versionType": "git"
            },
            {
              "lessThan": "b83557bc6f560433fe5d727e241069f8db5ba709",
              "status": "affected",
              "version": "5ef31ea5d053a8f493a772ebad3f3ce82c35d845",
              "versionType": "git"
            },
            {
              "lessThan": "2e5edb69e5d0e23ef248c56fc977039268c77a7b",
              "status": "affected",
              "version": "5ef31ea5d053a8f493a772ebad3f3ce82c35d845",
              "versionType": "git"
            },
            {
              "lessThan": "5c2c3c38be396257a6a2e55bd601a12bb9781507",
              "status": "affected",
              "version": "5ef31ea5d053a8f493a772ebad3f3ce82c35d845",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dbd9466d323a72e22efe09151253d195d36d3bf6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.124",
                  "versionStartIncluding": "6.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.70",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix outer network offset\n\nThe udp GRO complete stage assumes that all the packets inserted the RX\nhave the `encapsulation` flag zeroed. Such assumption is not true, as a\nfew H/W NICs can set such flag when H/W offloading the checksum for\nan UDP encapsulated traffic, the tun driver can inject GSO packets with\nUDP encapsulation and the problematic layout can also be created via\na veth based setup.\n\nDue to the above, in the problematic scenarios, udp4_gro_complete() uses\nthe wrong network offset (inner instead of outer) to compute the outer\nUDP header pseudo checksum, leading to csum validation errors later on\nin packet processing.\n\nAddress the issue always clearing the encapsulation flag at GRO completion\ntime. Such flag will be set again as needed for encapsulated packets by\nudp_gro_complete()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-18T17:41:00.591Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d40a85138568696387ef04cd004c64612a70874"
        },
        {
          "url": "https://git.kernel.org/stable/c/b83557bc6f560433fe5d727e241069f8db5ba709"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e5edb69e5d0e23ef248c56fc977039268c77a7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c2c3c38be396257a6a2e55bd601a12bb9781507"
        }
      ],
      "title": "net: gro: fix outer network offset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23254",
    "datePublished": "2026-03-18T17:41:00.591Z",
    "dateReserved": "2026-01-13T15:37:45.990Z",
    "dateUpdated": "2026-03-18T17:41:00.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-WJRJ-HVQV-FW2V

CVE-2026-23254 (GCVE-0-2026-23254)

Tags

Sightings

Nomenclature