CVE-2026-53235

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The skb gro receive list() function calls skb pull(skb, skb gro offset(skb)) without verifying if the data is in the linear area using pskb may pull(). When a socket buffer (skb) arrives via napi gro frags(), the skb headlen may be 0 while skb gro offset is non-zero. This causes skb pull() to decrement skb->len without changing skb->data len, triggering a BUG ON(skb->len < skb->data len) condition in the skb pull() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.