CVE-2026-23154

net: fix segmentation of forwarding fraglist GRO

Published Feb 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net: fix segmentation of forwarding fraglist GRO

This patch enhances GSO segment handling by properly checking
the SKB_GSO_DODGY flag for frag_list GSO packets, addressing
low throughput issues observed when a station accesses IPv4
servers via hotspots with an IPv6-only upstream interface.

Specifically, it fixes a bug in GSO segmentation when forwarding
GRO packets containing a frag_list. The function skb_segment_list
cannot correctly process GRO skbs that have been converted by XLAT,
since XLAT only translates the header of the head skb. Consequently,
skbs in the frag_list may remain untranslated, resulting in protocol
inconsistencies and reduced throughput.

To address this, the patch explicitly sets the SKB_GSO_DODGY flag
for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers
(bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO
packets as potentially modified after protocol translation. As a
result, GSO segmentation will avoid using skb_segment_list and
instead falls back to skb_segment for packets with the SKB_GSO_DODGY
flag. This ensures that only safe and fully translated frag_list
packets are processed by skb_segment_list, resolving protocol
inconsistencies and improving throughput when forwarding GRO packets
converted by XLAT.

Analysis

Technical impact

In the Linux kernel, the GSO segmentation routine incorrectly handles forwarded GRO packets that contain a frag_list following IPv4/IPv6 translation by XLAT. The bug causes protocol inconsistencies and a measurable drop in throughput because some fragments remain untranslated. This flaw leads to disrupted or corrupted traffic but does not establish a formal denial‑of‑service vector.

Affected Systems

The affected kernels are all release candidates in the 6.19 series, from RC1 through RC7, as identified by the CPE strings. Any system running one of these kernels without the patch is vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. An attacker could potentially trigger the faulty segmentation path by sending crafted packets over the network, which may result in degraded throughput or packet corruption, but no proven exploitation is documented.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 9122d7280b2303e835cdfec156bd932ac1f586ed
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 2cbef9ea5a0ac51863ede35c45f26931a85d3888
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 3e62db1e3140449608975e29e0979cc5f3b1cc07
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 3d48d59235c494d34e32052f768393111c0806ef
`9fd1ff5d2ac7181844735806b0a703c942365291`	affected	< 426ca15c7f6cb6562a081341ca88893a50c59fa2

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.69`	unaffected	≤ 6.12.*
`6.18.9`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[9fd1ff5d2ac7181844735806b0a703c942365291,3e62db1e3140449608975e29e0979cc5f3b1cc07)`	affected	code_commit	—
`[9fd1ff5d2ac7181844735806b0a703c942365291,3d48d59235c494d34e32052f768393111c0806ef)`	affected	code_commit	—
`[9fd1ff5d2ac7181844735806b0a703c942365291,426ca15c7f6cb6562a081341ca88893a50c59fa2)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	semver	—
`[6.12.69,6.13.0)`	unaffected	semver	—
`[6.18.9,6.19.0)`	unaffected	semver	—
`[6.19,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that incorporates the referenced patch (e.g., switch to kernel 6.19 RC8 or later).
Continue monitoring network throughput and packet error rates to ensure the mitigation is effective.
If an upgrade is not feasible, consider disabling or restricting XLAT functionality for traffic that may trigger the bug.

Generated by OpenCVE AI on October 23, 2026 at 08:31 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6243-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8570-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8594-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8604-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8605-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8570-2	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8669-1	Linux kernel (NVIDIA) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.183% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
https://git.kernel.org/stable/c/2cbef9ea5a0ac51863ede35c45f26931a85d3888
https://git.kernel.org/stable/c/3d48d59235c494d34e32052f768393111c0806ef
https://git.kernel.org/stable/c/3e62db1e3140449608975e29e0979cc5f3b1cc07
https://git.kernel.org/stable/c/426ca15c7f6cb6562a081341ca88893a50c59fa2
https://git.kernel.org/stable/c/9122d7280b2303e835cdfec156bd932ac1f586ed
https://lore.kernel.org/linux-cve-announce/2026021415-CVE-2026-23154-f658@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23154
https://www.cve.org/CVERecord?id=CVE-2026-23154

History

Oct 19, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Jun 11, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 25, 2026 10:45 AM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2cbef9ea5a0ac51863ede35c45f26931a85d3888 https://git.kernel.org/stable/c/9122d7280b2303e835cdfec156bd932ac1f586ed

Mar 18, 2026 2:30 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc7::::::
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Feb 16, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021415-CVE-2026-23154-f658@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23154 https://www.cve.org/CVERecord?id=CVE-2026-23154
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Feb 14, 2026 4:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface. Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput. To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT.
Title		net: fix segmentation of forwarding fraglist GRO
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3d48d59235c494d34e32052f768393111c0806ef https://git.kernel.org/stable/c/3e62db1e3140449608975e29e0979cc5f3b1cc07 https://git.kernel.org/stable/c/426ca15c7f6cb6562a081341ca88893a50c59fa2