CVE-2026-90063virtio-net: Ensure that TCP packets don't overflow gso_segs
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gso_segs The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size. Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before d3d111fe809773edbb4ae121e36253b7d683509a; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before 8f6667a081887c2b59c6f3dd86c1789ada563762; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before 339f47ae04dcc6b5a730dd6bc70dddc8937c3260; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before 29bd12c7c5f9d6cf855b87bace18f71e9607f9e8; 7c6d2ecbda83150b2036a2b36b21381ad4667762 builds before 0e5ed3b98d1d8d251acfdccfeaa607453ad12954; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before 75c271c48f483af678e514734e10b2452410e08c; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before c27c449d455aafd9018a3cbab150f1c42c87923f; bfbaf151efe491e30697e21c8b7ae1b615480873; and 7 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/d3d111fe809773edbb4ae121e36253b7d683509a
- https://git.kernel.org/stable/c/8f6667a081887c2b59c6f3dd86c1789ada563762
- https://git.kernel.org/stable/c/339f47ae04dcc6b5a730dd6bc70dddc8937c3260
- https://git.kernel.org/stable/c/29bd12c7c5f9d6cf855b87bace18f71e9607f9e8
- https://git.kernel.org/stable/c/0e5ed3b98d1d8d251acfdccfeaa607453ad12954
- https://git.kernel.org/stable/c/75c271c48f483af678e514734e10b2452410e08c
- https://git.kernel.org/stable/c/c27c449d455aafd9018a3cbab150f1c42c87923f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.