CVE-2026-72502

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the IPv6 TCP implementation where the ip6 default advmss() function can return a value of 65535 (IPV6 MAXPLEN) when the Maximum Transmission Unit (MTU) is large. This value is interpreted as mss clamp, allowing the Maximum Segment Size (MSS) to reach 65535. Because the value 0xFFFF (65535) is also used as a magic value for GSO BY FRAGS within the kernel, a TCP packet with gso size set to 0xFFFF passed to the skb segment() function is mistakenly treated as GSO BY FRAGS. This results in a NULL pointer dereference since local TCP packets do not utilize frag list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.