CVE-2026-72502tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference because local TCP packets do not use frag_list. Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large. Also update the stale comment in ip6_default_advmss() which suggested that IPV6_MAXPLEN is returned to mean "any MSS".
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 3953c46c3ac7eef31a9935427371c6f54a22f1ba builds before 560b33b434e922ef97f9ff23aa2e909ef7aacd5c; 3953c46c3ac7eef31a9935427371c6f54a22f1ba builds before 21f69ac1879bb970588d5e7c12a96e6542f7c1a7; from 3953c46c3ac7eef31a9935427371c6f54a22f1ba before c0db3dc2ac323b6c4b76adede3b355a9daa6dea8; 3953c46c3ac7eef31a9935427371c6f54a22f1ba builds before 572fff10819dfc359298d1f774839e76a4d96f93; 3953c46c3ac7eef31a9935427371c6f54a22f1ba builds before 8e6214a530c03e341dc1b0a846c8f2b716b3551a; from 3953c46c3ac7eef31a9935427371c6f54a22f1ba before d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e; from 3953c46c3ac7eef31a9935427371c6f54a22f1ba before a210791f33345aa87187f7d7a9f3b9b7f4a28e6d; 3953c46c3ac7eef31a9935427371c6f54a22f1ba builds before 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22 | CNA record |
References
- https://git.kernel.org/stable/c/560b33b434e922ef97f9ff23aa2e909ef7aacd5c
- https://git.kernel.org/stable/c/21f69ac1879bb970588d5e7c12a96e6542f7c1a7
- https://git.kernel.org/stable/c/c0db3dc2ac323b6c4b76adede3b355a9daa6dea8
- https://git.kernel.org/stable/c/572fff10819dfc359298d1f774839e76a4d96f93
- https://git.kernel.org/stable/c/8e6214a530c03e341dc1b0a846c8f2b716b3551a
- https://git.kernel.org/stable/c/d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e
- https://git.kernel.org/stable/c/a210791f33345aa87187f7d7a9f3b9b7f4a28e6d
- https://git.kernel.org/stable/c/2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.