Description
In the Linux kernel, the following vulnerability has been resolved:

gve: DQO: reject TSO packets with an out of range MSS

gve_prep_tso() notes that the device requires the MSS to be <= 9728,
but does not enforce it, assuming the 9K MTU enforced by the hypervisor
and the 64KB limit on TSO sizes are enough.

This does not hold for packets that were not generated locally.
A guest behind a tap, or any packet socket user, can provide an
arbitrary gso_size in virtio_net_hdr. Layer 2 forwarding does not check
the MTU for GSO packets (is_skb_forwardable()), and gso_features_check()
only bounds skb->len and gso_segs, never gso_size.

Such a packet reaches gve_tx_fill_tso_ctx_desc(), which puts gso_size
into the mss field of the TSO context descriptor. This field is 14 bits
wide, so a gso_size of 16384 is silently turned into an MSS of zero.

Drop these packets from gve_prep_tso(), and make sure that
gve_features_check_dqo() leaves their GSO bits alone: skb_segment()
splits at gso_size regardless of the MTU, so falling back to software
segmentation would give the device non TSO packets bigger than the
9728 bytes it supports.

Note that the device can still be given oversized non TSO packets when
the stack segments in software for other reasons, for instance after
TSO has been disabled with ethtool. This is a generic issue, because
the MTU check is skipped for GSO packets in the forwarding path, and
is addressed separately.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Linux kernel’s GVE driver allows an attacker to send TCP Segmentation Offload (TSO) packets whose maximum segment size (MSS) exceeds the 9728-byte limit that the device actually supports. The driver accepts packets whose gso_size is larger than this limit and silently truncates the MSS field in the transmitted descriptor, leading to malformed packets that can cause the virtual device or the host kernel to mis‑segment or crash.

Affected Systems

All Linux systems that include a GVE driver in the kernel prior to the application of the patch found in the listed commits are potentially vulnerable. The flaw is not tied to a particular distribution version; any kernel image containing the unpatched GVE code can be impacted.

Risk and Exploitability

The vulnerability is an input validation flaw. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation. Because it can be triggered by normal network traffic, an attacker who can send GSO packets to the affected device could cause a denial of service to the host or guest. The patch remediation is available through the kernel repository, and the attack path requires only the ability to send packets to the front‑end device.

Generated by OpenCVE AI on October 18, 2026 at 23:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel patch that implements the fix referenced in the Git commits linked in the advisory.
  • If the patch cannot be applied, disable the GVE driver or turn off GSO offloading for the affected network interface to prevent oversized segment handling.
  • Ensure that all GSO packets transmitted over the interface have an MSS no greater than 9728 bytes by adjusting the MTU or by sending non‑TSO packets only.

Generated by OpenCVE AI on October 18, 2026 at 23:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gve_prep_tso() notes that the device requires the MSS to be <= 9728, but does not enforce it, assuming the 9K MTU enforced by the hypervisor and the 64KB limit on TSO sizes are enough. This does not hold for packets that were not generated locally. A guest behind a tap, or any packet socket user, can provide an arbitrary gso_size in virtio_net_hdr. Layer 2 forwarding does not check the MTU for GSO packets (is_skb_forwardable()), and gso_features_check() only bounds skb->len and gso_segs, never gso_size. Such a packet reaches gve_tx_fill_tso_ctx_desc(), which puts gso_size into the mss field of the TSO context descriptor. This field is 14 bits wide, so a gso_size of 16384 is silently turned into an MSS of zero. Drop these packets from gve_prep_tso(), and make sure that gve_features_check_dqo() leaves their GSO bits alone: skb_segment() splits at gso_size regardless of the MTU, so falling back to software segmentation would give the device non TSO packets bigger than the 9728 bytes it supports. Note that the device can still be given oversized non TSO packets when the stack segments in software for other reasons, for instance after TSO has been disabled with ethtool. This is a generic issue, because the MTU check is skipped for GSO packets in the forwarding path, and is addressed separately.
Title gve: DQO: reject TSO packets with an out of range MSS
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:18:23.536Z

Reserved: 2026-09-25T10:25:14.357Z

Link: CVE-2026-98556

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:07.730

Modified: 2026-10-18T16:17:07.730

Link: CVE-2026-98556

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T23:15:14Z

Weaknesses
  • CWE-20

    Improper Input Validation