CVE-2026-98557

In the Linux kernel, the following vulnerability has been resolved:

gve: DQO: fix header length used by gve can send tso() for UDP GSO

gve can send tso() computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of every segment.

It unconditionally uses skb tcp all headers(), which reads the doff field of the TCP header. SKB GSO UDP L4 packets have no TCP header: tcp hdrlen() then reads one byte of the UDP payload, and header len can be anything in [0, 60] instead of the transport offset plus the eight bytes of the UDP header that gve prep tso() programs into the TSO context descriptor.

A wrong header length shifts all the segment boundaries computed in the loop, so the number of buffers per segment can be over or under estimated. In the first case, GSO is needlessly disabled for this packet by gve features check dqo() and the stack has to segment it. In the second case, the driver hands the device a packet whose segments span more than GVE TX MAX DATA DESCS buffers.

Use the UDP header length for SKB GSO UDP L4 packets, matching what gve prep tso() does.