CVE-2026-98557
Received Received - Intake

Buffer Overflow in Linux Kernel GVE Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO gve_can_send_tso() computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of every segment. It unconditionally uses skb_tcp_all_headers(), which reads the doff field of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header: tcp_hdrlen() then reads one byte of the UDP payload, and header_len can be anything in [0, 60] instead of the transport offset plus the eight bytes of the UDP header that gve_prep_tso() programs into the TSO context descriptor. A wrong header length shifts all the segment boundaries computed in the loop, so the number of buffers per segment can be over or under estimated. In the first case, GSO is needlessly disabled for this packet by gve_features_check_dqo() and the stack has to segment it. In the second case, the driver hands the device a packet whose segments span more than GVE_TX_MAX_DATA_DESCS buffers. Use the UDP header length for SKB_GSO_UDP_L4 packets, matching what gve_prep_tso() does.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98557
EUVD
EUVD-2026-103602

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 2f855c52a2e1d3c40d186549ac46cbd88b38eb49
Linux Linux 014c607f86abc903d7bf46e13373d89392e371fe
Linux Linux 014c607f86abc903d7bf46e13373d89392e371fe
Linux Linux 7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect header length calculation in the gve_can_send_tso() function for UDP GSO packets. The function uses skb_tcp_all_headers() which reads a TCP header field, but UDP packets lack a TCP header. This causes header_len to be miscalculated, leading to incorrect segment boundary computations. As a result, GSO may be disabled unnecessarily or the driver may send packets with segments spanning too many buffers.

Detection Guidance

This vulnerability is specific to the Linux kernel's gve driver and involves incorrect header length calculations for UDP GSO packets. Detection requires checking the kernel version and gve driver configuration. Use commands like 'uname -r' to check the kernel version and 'lsmod | grep gve' to verify if the gve module is loaded.

Impact Analysis

This vulnerability can cause performance degradation due to unnecessary GSO disabling, leading to increased CPU usage. In severe cases, it may cause packet transmission failures if segments exceed the maximum allowed buffers, potentially disrupting network communication for systems using the affected Linux kernel component.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. If using a vulnerable kernel, avoid using the gve driver with UDP GSO features or disable GSO for UDP traffic until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98557. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart