CVE-2026-80793ipv4: reject undersized MTUs in ip_do_fragment()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a716a64a4ba68cd46f2745fba2b1099fe8e0aa59; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 515b6816ba0c12d8415c88e5f41e6ec029e35cfa; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 74ce7389f8f562d39015f59a00ef7ad6acd37803; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b0ea911453ce7210e8200a07a94d2458bd1e6430; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 36e0741833bd823866f8cb9f112f37cea1a70b60; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d9d1a676b033acabf8e5645f730486d1f8204a3f; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3556beb8ca86677af2aca5bfbed6f8e790fccc83; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c8a74adccaf028223054633b532593101dfcc581; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/a716a64a4ba68cd46f2745fba2b1099fe8e0aa59
- https://git.kernel.org/stable/c/515b6816ba0c12d8415c88e5f41e6ec029e35cfa
- https://git.kernel.org/stable/c/74ce7389f8f562d39015f59a00ef7ad6acd37803
- https://git.kernel.org/stable/c/b0ea911453ce7210e8200a07a94d2458bd1e6430
- https://git.kernel.org/stable/c/36e0741833bd823866f8cb9f112f37cea1a70b60
- https://git.kernel.org/stable/c/d9d1a676b033acabf8e5645f730486d1f8204a3f
- https://git.kernel.org/stable/c/3556beb8ca86677af2aca5bfbed6f8e790fccc83
- https://git.kernel.org/stable/c/c8a74adccaf028223054633b532593101dfcc581
- https://git.kernel.org/stable/c/c0726f0caf8c6b3208552949e17d23634a2f3129
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.