CVE-2026-68136

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Generic Receive Offload (GRO) implementation where packets marked with the flush flag in NAPI GRO CB(skb) may be incorrectly re-aggregated. This occurs because the skb gro receive list() function lacks the validation check present in skb gro receive(). In scenarios such as tethering or device forwarding, already-aggregated packets with an existing frag list can be re-aggregated into a new GRO session, leading to corruption of the frag list chain structure. When the skb segment() function attempts to unpack these malformed packets, it may dereference NULL or corrupted pointers, resulting in a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.