CVE-2026-68136net: gro: fix double aggregation of flush-marked skbs
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive_list() lacks the same validation. As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be re-aggregated. This allows already-GRO'd packets with existing frag_list to be re-aggregated into a new GRO session, corrupting the frag_list chain structure. When skb_segment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic. Scenario (Tethering/Device forwarding): 1. Driver: Generated aggregated packet P1 via LRO with frag_list 2. Dev A: Receives aggregated fraglist packet and flush flag set 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called 4. Missing flush check allows re-aggregation despite flush flag 5. Frag_list chain becomes corrupted (loops or dangling refs) 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list Root cause in skb_segment(): The check at line ~4891: if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) && (skb_headlen(list_skb) == len || sg)) { When frag_list is corrupted by double aggregation, when list_skb is a NULL pointer from skb->next, skb_headlen(list_skb) dereference NULL/corrupted pointers occurs. Call Trace: skb_headlen(NULL skb) skb_segment tcp_gso_segment tcp4_gso_segment inet_gso_segment skb_mac_gso_segment __skb_gso_segment skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit qdisc_restart __qdisc_run qdisc_run net_tx_action Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in skb_gro_receive_list(), matching the defensive programming pattern of skb_gro_receive().
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 before 7fc7e35212cf58c134310fb47566a844297ceae9; from 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 before d1fb23f8f794ac4683127bd49a6422bd87e0ac02; from 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 before db3e82da616f52e2b27e25e7be3fde2f2a5e54d6; from 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 before 107e1a469f53a2a70874f3f12bf6fcd23925da1d; from 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 before a4dfd46cc8f08a29c6183794790547d0945f3d45; from 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 before fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0; from 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 before e751256486d0ded20f5a9f9863467f1dce65142f | CNA record |
References
- https://git.kernel.org/stable/c/7fc7e35212cf58c134310fb47566a844297ceae9
- https://git.kernel.org/stable/c/d1fb23f8f794ac4683127bd49a6422bd87e0ac02
- https://git.kernel.org/stable/c/db3e82da616f52e2b27e25e7be3fde2f2a5e54d6
- https://git.kernel.org/stable/c/107e1a469f53a2a70874f3f12bf6fcd23925da1d
- https://git.kernel.org/stable/c/a4dfd46cc8f08a29c6183794790547d0945f3d45
- https://git.kernel.org/stable/c/fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0
- https://git.kernel.org/stable/c/e751256486d0ded20f5a9f9863467f1dce65142f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.