Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-90063 Details

Description

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gso_segs The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size. Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://git.kernel.org/stable/c/0e5ed3b98d1d8d251acfdccfeaa607453ad12954	kernel.org
https://git.kernel.org/stable/c/29bd12c7c5f9d6cf855b87bace18f71e9607f9e8	kernel.org
https://git.kernel.org/stable/c/339f47ae04dcc6b5a730dd6bc70dddc8937c3260	kernel.org
https://git.kernel.org/stable/c/75c271c48f483af678e514734e10b2452410e08c	kernel.org
https://git.kernel.org/stable/c/8f6667a081887c2b59c6f3dd86c1789ada563762	kernel.org
https://git.kernel.org/stable/c/c27c449d455aafd9018a3cbab150f1c42c87923f	kernel.org
https://git.kernel.org/stable/c/d3d111fe809773edbb4ae121e36253b7d683509a	kernel.org

see all 7 references

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes