In the Linux kernel, the gve driver incorrectly calculates the header length for UDP GSO packets by unconditionally using skb_tcp_all_headers(), which reads the TCP doff field. Because UDP packets lack a TCP header, the function ends up using a length that can be anywhere from 0 to 60 bytes, instead of the correct UDP header length plus the eight bytes of the UDP header programmed into the TSO context descriptor. This miscalculation shifts the computed segment boundaries, causing either the kernel to unnecessarily disable GSO and perform manual segmentation, or the driver to hand the device a packet whose segments span more than the device’s maximum number of data descriptors. This bug can lead to kernel or device misbehavior, such as out‑of‑bounds descriptor usage, which in turn can crash the driver, drop packets, or otherwise destabilize the network stack. The impact is reasonably severe, potentially resulting in a denial of service if an attacker can repeatedly trigger the condition using crafted UDP traffic. Because the vulnerability is tied to the kernel’s handling of UDP GSO, the primary attack vector is local or remote traffic that enables GSO on the affected GVE device. An attacker could send large UDP packets from a vulnerable host or exploit a remote service that transmits data through the GVE driver.

The affected product is the Linux kernel. No specific version list is provided in the data, but the fix was introduced in a recent commit to the mainline kernel. Any distribution that uses the Linux kernel without the new commit is potentially vulnerable.

The CVSS score is not listed, and the EPSS score is not available, so the exact severity is unknown. The vulnerability is not tracked in CISA’s KEV catalog. However, the bug can trigger a loss of service and, depending on kernel handling, could lead to driver crashes. The risk is moderate to high for systems that enable GSO on GVE devices and lack the patch.