net: always dissect GSO packets in __virtio_net_hdr_to_skb()
In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in __virtio_net_hdr_to_skb() Commit 9e8db5913264 ("net: avoid false positives in untrusted gso validation") added a '&& skb->network_header' check before flow-dissecting GSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM in __virtio_net_hdr_to_skb(), because some callers (such as tun_get_user(), tun_xdp_one(), virtnet_receive_done(), and raw_verify_header()) called virtio_net_hdr_*_to_skb() before initializing skb->network_header and skb->dev. Because __alloc_skb() and __build_skb_around() zero-initialize skb->network_header to 0 (unlike mac_header and transport_header which are initialized to ~0U), those four callers always had skb->network_header == 0 and bypassed flow dissection in __virtio_net_hdr_to_skb(). More generally, skb->network_header is an offset from skb->head (where 0 is also a valid offset whenever skb_headroom(skb) is 0), not a boolean flag. Whenever the 'if (gso_type && skb->network_header)' branch was skipped, the fallback 'else if (gso_type)' only pulled nh_min_len + thlen (40 bytes for TCPv4) without dissecting the packet, without validating ip_proto or n_proto, and without setting skb->transport_header. If the packet has a malformed network header, it is not rejected and a subsequent skb_probe_transport_header() also fails, leaving skb->transport_header at ~0U (0xffff). Similarly, if an IPv4 packet carries IP options (ihl > 5) or an IPv6 packet carries extens
CVE-2026-98954
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98954
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d5be7f632bad0f489879eed0ff4b99bd7fe0b74c",
"lessThan": "5f4dfdf0077730e9d3ef5b37ceb17a5a56d6f34c",
"versionType": "git"
},
{
"status": "affected",
"version": "d5be7f632bad0f489879eed0ff4b99bd7fe0b74c",
"lessThan": "44378d02c5aaae24b60a75fbbb539b4aa4db503d",
"versionType": "git"
},
{
"status": "affected",
"version": "dac7d4432b13d6b58923c1178b786bcda37c9e9e",
"versionType": "git"
},
{
"status": "affected",
"version": "e93384b12443c9bb6830b56b7d299beed432b865",
"versionType": "git"
},
{
"status": "affected",
"version": "f709f7b28d76de327373598a0fda9f916c36b5e6",
"versionType": "git"
},
{
"status": "affected",
"version": "d996573ebd5c528c613e90b7e7daa961d58fa16e",
"versionType": "git"
},
{
"status": "affected",
"version": "c375152be9dd9d6fbf6ae5ac8be337d0590f192a",
"versionType": "git"
},
{
"status": "affected",
"version": "0dab7eb86ea06ce8c530785f1999948c6f223c96",
"versionType": "git"
},
{
"status": "affected",
"version": "ea3fb2ce5fa794d02135f5c079e05cd6fc3f545d",
"versionType": "git"
},
{
"status": "affected",
"version": "54ef8243c3c8e90f1ea5792e6752e021a25c8eb3",
"versionType": "git"
},
{
"status": "affected",
"version": "4.14.104",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.26",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.20.13",
"lessThan": "4.21",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.14.226",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.181",
"lessThan": "4.20",
"versionType": "semver"
}
],
"programFiles": [
"arch/um/drivers/vector_transports.c",
"drivers/net/tun.c",
"drivers/net/virtio_net.c",
"include/linux/virtio_net.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/um/drivers/vector_transports.c",
"drivers/net/tun.c",
"drivers/net/virtio_net.c",
"include/linux/virtio_net.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98954
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #52809 · Revision 1
- Added to Heist Feed
- Publisher date