CVE-2026-68136 - Vulnerability Details

- net: gro: fix double aggregation of flush-marked skbs

Description

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix double aggregation of flush-marked skbs

Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO
packet.") added a flush check to skb_gro_receive(), but
skb_gro_receive_list() lacks the same validation.

As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be
re-aggregated.

This allows already-GRO'd packets with existing frag_list to be
re-aggregated into a new GRO session, corrupting the frag_list chain
structure. When skb_segment() attempts to unpack these malformed packets,
it encounters invalid state and triggers a kernel panic.

Scenario (Tethering/Device forwarding):
1. Driver: Generated aggregated packet P1 via LRO with frag_list
2. Dev A: Receives aggregated fraglist packet and flush flag set
3. Dev A: Re-enters GRO, skb_gro_receive_list() is called
4. Missing flush check allows re-aggregation despite flush flag
5. Frag_list chain becomes corrupted (loops or dangling refs)
6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list

Root cause in skb_segment():
The check at line ~4891:
if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) &&
(skb_headlen(list_skb) == len || sg)) {

When frag_list is corrupted by double aggregation, when list_skb is
a NULL pointer from skb->next, skb_headlen(list_skb) dereference
NULL/corrupted pointers occurs.

Call Trace:
skb_headlen(NULL skb)
skb_segment
tcp_gso_segment
tcp4_gso_segment
inet_gso_segment
skb_mac_gso_segment
__skb_gso_segment
skb_gso_segment
validate_xmit_skb
validate_xmit_skb_list
sch_direct_xmit
qdisc_restart
__qdisc_run
qdisc_run
net_tx_action

Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in
skb_gro_receive_list(), matching the defensive programming pattern of
skb_gro_receive().

Published: 2026-08-10

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Packets aggregated via GRO may be marked to flush, and the Linux kernel incorrectly allows these marked packets to be re‑aggregated. This double aggregation corrupts the frag_list chain. When the kernel attempts to segment the packet, a null‑pointer dereference occurs, causing a kernel panic. The flaw results in a system crash, denying availability and affecting integrity by corrupting internal packet structures.

Affected Systems

All Linux kernel versions that lack the commit 0ab03f353d36 and thus still exhibit the double aggregation flaw are vulnerable. In practice, this includes any kernel using the Generic Receive Offload (GRO) and Generic Segmentation Offload (GSO) features before that patch. Devices employing tethering, device forwarding, or any network interface capable of receiving large aggregated packets with a flush flag set would fall under the attack surface.

Risk and Exploitability

The CVSS score is 9.8 and the EPSS score is less than 1%, indicating a critical severity but a low current exploitation probability. The likely attack vector is network‑based, inferred from the description that an attacker must inject a malicious packet with a flush flag into an interface that processes GRO. Exploitation requires precise triggering of the flush condition and a GSO‑enabled path; when successful the kernel panics immediately. While widespread exploitation is uncertain, any device exposed to potentially untrusted traffic presents a plausible risk. This vulnerability is not currently listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3a1296a38d0cf62bffb9a03c585cbd5dbf15d596`	affected	< 7fc7e35212cf58c134310fb47566a844297ceae9
`3a1296a38d0cf62bffb9a03c585cbd5dbf15d596`	affected	< d1fb23f8f794ac4683127bd49a6422bd87e0ac02
`3a1296a38d0cf62bffb9a03c585cbd5dbf15d596`	affected	< db3e82da616f52e2b27e25e7be3fde2f2a5e54d6
`3a1296a38d0cf62bffb9a03c585cbd5dbf15d596`	affected	< 107e1a469f53a2a70874f3f12bf6fcd23925da1d
`3a1296a38d0cf62bffb9a03c585cbd5dbf15d596`	affected	< a4dfd46cc8f08a29c6183794790547d0945f3d45
`3a1296a38d0cf62bffb9a03c585cbd5dbf15d596`	affected	< fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0
`3a1296a38d0cf62bffb9a03c585cbd5dbf15d596`	affected	< e751256486d0ded20f5a9f9863467f1dce65142f

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.266`	unaffected	≤ 5.10.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3a1296a38d0cf62bffb9a03c585cbd5dbf15d596,107e1a469f53a2a70874f3f12bf6fcd23925da1d)`	affected	code_commit	—
`[3a1296a38d0cf62bffb9a03c585cbd5dbf15d596,a4dfd46cc8f08a29c6183794790547d0945f3d45)`	affected	code_commit	—
`[3a1296a38d0cf62bffb9a03c585cbd5dbf15d596,fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0)`	affected	code_commit	—
`[3a1296a38d0cf62bffb9a03c585cbd5dbf15d596,e751256486d0ded20f5a9f9863467f1dce65142f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	generic	—
`[0,5.6)`	unaffected	generic	—
`[6.12.101,6.13.0]`	unaffected	semver	—
`[6.18.42,6.19.0]`	unaffected	semver	—
`[7.1.6,7.2.0]`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes commit 0ab03f353d36, which adds the missing flush validation in skb_gro_receive_list().
If a kernel update cannot be performed, disable GRO or GSO on vulnerable network interfaces using ethtool –K <iface> gro off gso off to eliminate the re‑aggregation scenario.
Implement network filtering or segmentation to block untrusted aggregated packets from reaching the target system, reducing the chance of triggering the vulnerability.

Generated by OpenCVE AI on August 13, 2026 at 23:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00546.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/107e1a469f53a2a70874f3f12bf6fcd23925da1d
https://git.kernel.org/stable/c/7fc7e35212cf58c134310fb47566a844297ceae9
https://git.kernel.org/stable/c/a4dfd46cc8f08a29c6183794790547d0945f3d45
https://git.kernel.org/stable/c/d1fb23f8f794ac4683127bd49a6422bd87e0ac02
https://git.kernel.org/stable/c/db3e82da616f52e2b27e25e7be3fde2f2a5e54d6
https://git.kernel.org/stable/c/e751256486d0ded20f5a9f9863467f1dce65142f
https://git.kernel.org/stable/c/fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0
https://nvd.nist.gov/vuln/detail/CVE-2026-68136
https://www.cve.org/CVERecord?id=CVE-2026-68136

History

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7fc7e35212cf58c134310fb47566a844297ceae9 https://git.kernel.org/stable/c/d1fb23f8f794ac4683127bd49a6422bd87e0ac02 https://git.kernel.org/stable/c/db3e82da616f52e2b27e25e7be3fde2f2a5e54d6

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 09:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68136 https://www.cve.org/CVERecord?id=CVE-2026-68136
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive_list() lacks the same validation. As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be re-aggregated. This allows already-GRO'd packets with existing frag_list to be re-aggregated into a new GRO session, corrupting the frag_list chain structure. When skb_segment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic. Scenario (Tethering/Device forwarding): 1. Driver: Generated aggregated packet P1 via LRO with frag_list 2. Dev A: Receives aggregated fraglist packet and flush flag set 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called 4. Missing flush check allows re-aggregation despite flush flag 5. Frag_list chain becomes corrupted (loops or dangling refs) 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list Root cause in skb_segment(): The check at line ~4891: if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) && (skb_headlen(list_skb) == len \|\| sg)) { When frag_list is corrupted by double aggregation, when list_skb is a NULL pointer from skb->next, skb_headlen(list_skb) dereference NULL/corrupted pointers occurs. Call Trace: skb_headlen(NULL skb) skb_segment tcp_gso_segment tcp4_gso_segment inet_gso_segment skb_mac_gso_segment __skb_gso_segment skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit qdisc_restart __qdisc_run qdisc_run net_tx_action Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in skb_gro_receive_list(), matching the defensive programming pattern of skb_gro_receive().
Title		net: gro: fix double aggregation of flush-marked skbs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/107e1a469f53a2a70874f3f12bf6fcd23925da1d https://git.kernel.org/stable/c/a4dfd46cc8f08a29c6183794790547d0945f3d45 https://git.kernel.org/stable/c/e751256486d0ded20f5a9f9863467f1dce65142f https://git.kernel.org/stable/c/fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:58:59.450Z

Updated: 2026-08-23T12:45:54.689Z

Reserved: 2026-07-30T09:28:09.370Z

Link: CVE-2026-68136

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:19:59.120

Modified: 2026-08-23T13:16:33.620

Link: CVE-2026-68136

Redhat

Severity : Moderate

Publid Date: 2026-08-10T11:58:59Z

Links: CVE-2026-68136 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-14T00:00:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object