CVE-2026-68136
Received Received - Intake

Double GRO Aggregation Flaw in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive_list() lacks the same validation. As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be re-aggregated. This allows already-GRO'd packets with existing frag_list to be re-aggregated into a new GRO session, corrupting the frag_list chain structure. When skb_segment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic. Scenario (Tethering/Device forwarding): 1. Driver: Generated aggregated packet P1 via LRO with frag_list 2. Dev A: Receives aggregated fraglist packet and flush flag set 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called 4. Missing flush check allows re-aggregation despite flush flag 5. Frag_list chain becomes corrupted (loops or dangling refs) 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list Root cause in skb_segment(): The check at line ~4891: if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) && (skb_headlen(list_skb) == len || sg)) { When frag_list is corrupted by double aggregation, when list_skb is a NULL pointer from skb->next, skb_headlen(list_skb) dereference NULL/corrupted pointers occurs. Call Trace: skb_headlen(NULL skb) skb_segment tcp_gso_segment tcp4_gso_segment inet_gso_segment skb_mac_gso_segment __skb_gso_segment skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit qdisc_restart __qdisc_run qdisc_run net_tx_action Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in skb_gro_receive_list(), matching the defensive programming pattern of skb_gro_receive().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68136
EUVD
EUVD-2026-55517

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where packets marked for flushing during network processing can be incorrectly re-aggregated. The issue occurs because skb_gro_receive_list() lacks a flush check present in skb_gro_receive(). This causes corruption in the frag_list chain structure, leading to kernel panics when the corrupted packets are processed by skb_segment().

Detection Guidance

This vulnerability is specific to the Linux kernel's GRO (Generic Receive Offload) implementation and may not have direct user-space detection commands. Monitor kernel logs for crashes related to skb_segment or GRO operations, especially during high network traffic or packet aggregation scenarios.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) when network packets are processed, particularly in scenarios involving packet forwarding or tethering. Attackers could exploit this to trigger denial-of-service conditions on affected systems.

Mitigation Strategies

Apply the kernel patch that adds the missing flush check to skb_gro_receive_list(). Update to a Linux kernel version that includes the fix (commit 0ab03f353d36 or later). If immediate patching is not possible, disable GRO or LRO (Large Receive Offload) on affected network interfaces as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart