CVE-2026-23254 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix outer network offset The udp GRO complete stage assumes that all the packets inserted the RX have the `encapsulation` flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup. Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner instead of outer) to compute the outer UDP header pseudo checksum, leading to csum validation errors later on in packet processing. Address the issue always clearing the encapsulation flag at GRO completion time. Such flag will be set again as needed for encapsulated packets by udp_gro_complete().
A vulnerability in the Linux kernel's UDP Generic Receive Offload (GRO) handling has been addressed. The issue arose because the GRO completion stage incorrectly assumed that all received packets had the 'encapsulation' flag cleared. This assumption was false, as some hardware network interface controllers (NICs) could set the flag when offloading UDP checksums for encapsulated traffic. Additionally, the TUN driver could inject Generic Segmentation Offload (GSO) packets with UDP encapsulation, and a similar problematic scenario could be created using a virtual Ethernet (veth) setup. In these cases, the 'udp4_gro_complete()' function used the wrong network offset, leading to checksum validation errors in subsequent packet processing. The vulnerability has been fixed by ensuring the encapsulation flag is cleared during the GRO completion process, allowing it to be correctly set for encapsulated packets as needed.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2e5edb69e5d0e23ef248c56fc977039268c77a7b | kernel.org | Patch |
| https://git.kernel.org/stable/c/5c2c3c38be396257a6a2e55bd601a12bb9781507 | kernel.org | Patch |
| https://git.kernel.org/stable/c/9d40a85138568696387ef04cd004c64612a70874 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b83557bc6f560433fe5d727e241069f8db5ba709 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.6.31, < 6.6.124 >= 6.8.10, < 6.9 >= 6.9.1, < 6.12.70 >= 6.13, < 6.18.10 6.9 - 6.9 rc7 6.19 rc1 6.19 rc2 6.19 rc3 6.19 rc4 6.19 rc5 6.19 rc6 6.19 rc7 6.19 rc8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | kernel.org |