CVE-2026-72502

Received Received - Intake

TCP MSS Clamping Issue in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference because local TCP packets do not use frag_list. Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large. Also update the stale comment in ip6_default_advmss() which suggested that IPV6_MAXPLEN is returned to mean "any MSS".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72502

EUVD

EUVD-2026-59401

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	to 65534 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a NULL pointer dereference in TCP/IPv6 handling. When the Maximum Transmission Unit (MTU) is large, the function ip6_default_advmss() returns 65535 (IPV6_MAXPLEN), which is also used as a magic value GSO_BY_FRAGS. This causes TCP packets with gso_size=65535 to be misinterpreted as GSO_BY_FRAGS, leading to a NULL pointer dereference during packet segmentation.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv6 TCP implementation. Detection requires checking kernel logs for NULL pointer dereference errors related to TCP segmentation or GSO_BY_FRAGS. Monitor system logs with commands like 'dmesg | grep -i segfault' or 'journalctl -k | grep -i null pointer dereference'.

Impact Analysis

This vulnerability can cause system crashes due to NULL pointer dereferences, leading to denial-of-service conditions. Systems using IPv6 with large MTU values may be affected, potentially disrupting network services and applications relying on TCP/IPv6.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel networking issue. Compliance impacts would only occur if the vulnerability were exploited to cause system instability or denial of service, potentially affecting data processing or availability.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the issue. If immediate patching is not possible, consider disabling IPv6 TCP segmentation offload (TSO) temporarily using 'ethtool -K <interface> tso off' or limiting MTU sizes to prevent large MSS values.

Hi! I’m here to help you understand CVE-2026-72502. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70