CVE-2026-23154 - Vulnerability Details

- net: fix segmentation of forwarding fraglist GRO

Description

In the Linux kernel, the following vulnerability has been resolved:

net: fix segmentation of forwarding fraglist GRO

This patch enhances GSO segment handling by properly checking
the SKB_GSO_DODGY flag for frag_list GSO packets, addressing
low throughput issues observed when a station accesses IPv4
servers via hotspots with an IPv6-only upstream interface.

Specifically, it fixes a bug in GSO segmentation when forwarding
GRO packets containing a frag_list. The function skb_segment_list
cannot correctly process GRO skbs that have been converted by XLAT,
since XLAT only translates the header of the head skb. Consequently,
skbs in the frag_list may remain untranslated, resulting in protocol
inconsistencies and reduced throughput.

To address this, the patch explicitly sets the SKB_GSO_DODGY flag
for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers
(bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO
packets as potentially modified after protocol translation. As a
result, GSO segmentation will avoid using skb_segment_list and
instead falls back to skb_segment for packets with the SKB_GSO_DODGY
flag. This ensures that only safe and fully translated frag_list
packets are processed by skb_segment_list, resolving protocol
inconsistencies and improving throughput when forwarding GRO packets
converted by XLAT.

Published: 2026-02-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the GSO segmentation routine incorrectly handles forwarded GRO packets that contain a frag_list following IPv4/IPv6 translation by XLAT. The bug causes protocol inconsistencies and a measurable drop in throughput because some fragments remain untranslated. This flaw leads to disrupted or corrupted traffic but does not establish a formal denial‑of‑service vector.

Affected Systems

The affected kernels are all release candidates in the 6.19 series, from RC1 through RC7, as identified by the CPE strings. Any system running one of these kernels without the patch is vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. An attacker could potentially trigger the faulty segmentation path by sending crafted packets over the network, which may result in degraded throughput or packet corruption, but no proven exploitation is documented.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 9122d7280b2303e835cdfec156bd932ac1f586ed
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 2cbef9ea5a0ac51863ede35c45f26931a85d3888
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 3e62db1e3140449608975e29e0979cc5f3b1cc07
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 3d48d59235c494d34e32052f768393111c0806ef
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 426ca15c7f6cb6562a081341ca88893a50c59fa2

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.69`	unaffected	≤ 6.12.*
`6.18.9`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`[9fd1ff5d2ac7181844735806b0a703c942365291,3e62db1e3140449608975e29e0979cc5f3b1cc07)`	affected	code_commit	—
`[9fd1ff5d2ac7181844735806b0a703c942365291,3d48d59235c494d34e32052f768393111c0806ef)`	affected	code_commit	—
`[9fd1ff5d2ac7181844735806b0a703c942365291,426ca15c7f6cb6562a081341ca88893a50c59fa2)`	affected	code_commit	—

Linux

Linux Kernel

—

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	semver	—
`[6.12.69,6.13.0)`	unaffected	semver	—
`[6.18.9,6.19.0)`	unaffected	semver	—
`[6.19,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the referenced patch (e.g., switch to kernel 6.19 RC8 or later).
Continue monitoring network throughput and packet error rates to ensure the mitigation is effective.
If an upgrade is not feasible, consider disabling or restricting XLAT functionality for traffic that may trigger the bug.

Generated by OpenCVE AI on April 17, 2026 at 19:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2cbef9ea5a0ac51863ede35c45f26931a85d3888
https://git.kernel.org/stable/c/3d48d59235c494d34e32052f768393111c0806ef
https://git.kernel.org/stable/c/3e62db1e3140449608975e29e0979cc5f3b1cc07
https://git.kernel.org/stable/c/426ca15c7f6cb6562a081341ca88893a50c59fa2
https://git.kernel.org/stable/c/9122d7280b2303e835cdfec156bd932ac1f586ed
https://lore.kernel.org/linux-cve-announce/2026021415-CVE-2026-23154-f658@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23154
https://www.cve.org/CVERecord?id=CVE-2026-23154

History

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2cbef9ea5a0ac51863ede35c45f26931a85d3888 https://git.kernel.org/stable/c/9122d7280b2303e835cdfec156bd932ac1f586ed

Wed, 18 Mar 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Mon, 16 Feb 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021415-CVE-2026-23154-f658@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23154 https://www.cve.org/CVERecord?id=CVE-2026-23154
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 14 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface. Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput. To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT.
Title		net: fix segmentation of forwarding fraglist GRO
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3d48d59235c494d34e32052f768393111c0806ef https://git.kernel.org/stable/c/3e62db1e3140449608975e29e0979cc5f3b1cc07 https://git.kernel.org/stable/c/426ca15c7f6cb6562a081341ca88893a50c59fa2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-02-14T16:01:21.758Z

Updated: 2026-03-25T10:20:26.462Z

Reserved: 2026-01-13T15:37:45.977Z

Link: CVE-2026-23154

Vulnrichment

No data.

NVD

Status : Modified

Published: 2026-02-14T16:15:55.550

Modified: 2026-03-25T11:16:19.400

Link: CVE-2026-23154

Redhat

Severity : Moderate

Publid Date: 2026-02-14T00:00:00Z

Links: CVE-2026-23154 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-17T19:45:25Z

Weaknesses

NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object