CVE-2026-80590

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists where a virtio net hdr (used in tun/tap or AF PACKET with PACKET VNET HDR) can incorrectly mark IPv4 or IPv6 fragments as Generic Segmentation Offload (GSO). The functions inet frag reasm prepare() and inet frag reasm finish() retain the GSO state of the first fragment as the head of the reassembled datagram. Consequently, after ip defrag(), the reassembled socket buffer (skb) still claims to be GSO, leading to a kernel panic when processed by skb segment() due to an invalid frag list walk. This can be triggered by an unprivileged user in their own user namespace via two writes to a tap device, or by a guest whose Virtual Machine Monitor (VMM) forwards virtio net hdr to a tap. The issue is rooted in the inet frag queue insert() function, which is shared by IPv4, IPv6, nf conntrack reasm, and 6lowpan reassembly.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.