PT-2026-83418 · Linux · Linux
CVE-2026-80725
·
Published
2026-08-29
·
Updated
2026-08-29
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: gro: properly validate BIG TCP aggregation criteria
When GRO attempts to aggregate packets beyond GRO LEGACY MAX SIZE (64KB),
BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP
(with sufficient MAC header room to insert the temporary HBH jumbo header).
However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp")
loosened the check in skb gro receive(), leading to several issues:
- skb gro receive() checked skb headroom(p) instead of the actual space before the MAC header (p->mac header). Because skb headroom(p) includes mac len, crafted frames (e.g. injected via AF PACKET) can pass the check with p->mac header < 8 bytes. When ipv6 gro complete() inserts the temporary HBH jumbo header, the memmove() starts before skb->head, causing an out-of-bounds write and wrapping skb->mac header.
- It allowed non-IP protocols such as software VLAN (ETH P 8021Q / ETH P 8021AD) to aggregate beyond 64KB because p->protocol != ETH P IPV6 was true.
- It checked p->encapsulation instead of NAPI GRO CB(skb)->encap mark, allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate beyond 64KB.
Fix skb gro receive() to strictly enforce:
- NAPI GRO CB(skb)->proto == IPPROTO TCP
- Not encapsulated (!NAPI GRO CB(skb)->encap mark && !p->encapsulation)
- Protocol must be either ETH P IP or ETH P IPV6
- If ETH P IPV6, p->mac header must be at least sizeof(struct hop jumbo hdr)
Returning -E2BIG from skb gro receive() ensures that packets which cannot
become BIG TCP are cleanly flushed at <= 64KB and delivered intact without
dropping.
This issue does not exist in mainline (7.0+) because the subsystem was
rewritten in commit 81be30c1f5f2 ("net/ipv6: Drop HBH for BIG TCP on RX
side"), making this fix relevant only for older stable branches like
6.18.y.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux