linux-cve-announce - CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2026021415-CVE-2026-23154-f658@gregkh>
Date: Sat, 14 Feb 2026 17:04:20 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: fix segmentation of forwarding fraglist GRO

This patch enhances GSO segment handling by properly checking
the SKB_GSO_DODGY flag for frag_list GSO packets, addressing
low throughput issues observed when a station accesses IPv4
servers via hotspots with an IPv6-only upstream interface.

Specifically, it fixes a bug in GSO segmentation when forwarding
GRO packets containing a frag_list. The function skb_segment_list
cannot correctly process GRO skbs that have been converted by XLAT,
since XLAT only translates the header of the head skb. Consequently,
skbs in the frag_list may remain untranslated, resulting in protocol
inconsistencies and reduced throughput.

To address this, the patch explicitly sets the SKB_GSO_DODGY flag
for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers
(bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO
packets as potentially modified after protocol translation. As a
result, GSO segmentation will avoid using skb_segment_list and
instead falls back to skb_segment for packets with the SKB_GSO_DODGY
flag. This ensures that only safe and fully translated frag_list
packets are processed by skb_segment_list, resolving protocol
inconsistencies and improving throughput when forwarding GRO packets
converted by XLAT.

The Linux kernel CVE team has assigned CVE-2026-23154 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.6 with commit 9fd1ff5d2ac7181844735806b0a703c942365291 and fixed in 6.12.69 with commit 3e62db1e3140449608975e29e0979cc5f3b1cc07
	Issue introduced in 5.6 with commit 9fd1ff5d2ac7181844735806b0a703c942365291 and fixed in 6.18.9 with commit 3d48d59235c494d34e32052f768393111c0806ef
	Issue introduced in 5.6 with commit 9fd1ff5d2ac7181844735806b0a703c942365291 and fixed in 6.19 with commit 426ca15c7f6cb6562a081341ca88893a50c59fa2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-23154
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	net/core/filter.c
	net/ipv4/tcp_offload.c
	net/ipv4/udp_offload.c
	net/ipv6/tcpv6_offload.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3e62db1e3140449608975e29e0979cc5f3b1cc07
	https://git.kernel.org/stable/c/3d48d59235c494d34e32052f768393111c0806ef
	https://git.kernel.org/stable/c/426ca15c7f6cb6562a081341ca88893a50c59fa2