CVE-2026-98853
Received Received - Intake

Linux Kernel Stack Exhaustion in GSO Segmentation

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stack. Making inet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP GSO/TSO later made the path reachable. The IPv6 stackable path was introduced separately and uses the same guard. Count IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once per top-level GSO operation and preserved across GRE/UDP context changes. Use the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first five entries pass, and the sixth returns -EINVAL before dispatching another GSO callback.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98853
EUVD
EUVD-2026-103793

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 3347c960295583eee3fd58e5c539fb1972fbc005
Linux Linux 3347c960295583eee3fd58e5c539fb1972fbc005
Linux Linux 3.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in IP-in-IP GSO (Generic Segmentation Offload) handling. It allows deep nesting of IP headers to exhaust the kernel stack by re-entering segmentation functions repeatedly. The issue arises because encap_level tracks header bytes rather than callback depth, enabling unbounded recursion. The fix limits recursive segmentation using IP_TUNNEL_RECURSION_LIMIT to prevent stack exhaustion.

Detection Guidance

This vulnerability involves kernel stack exhaustion due to deep IP-in-IP GSO nesting. Detection requires checking kernel logs for stack overflow errors or monitoring for crashes during network traffic processing. Use commands like dmesg | grep -i stack or journalctl -k | grep -i stack to identify stack overflows. Check for kernel panics or oops messages related to network processing.

Impact Analysis

This vulnerability could cause system instability or crashes due to kernel stack exhaustion. Attackers might exploit it to trigger denial-of-service conditions by sending specially crafted network packets. Systems using IP-in-IP GSO or TSO (TCP Segmentation Offload) for IPv4/IPv6 could be affected, leading to service disruptions or unexpected behavior.

Mitigation Strategies

Apply the latest Linux kernel patches addressing CVE-2026-98853. Disable IP-in-IP GSO if not required by setting net.core.gso.ipv4=0 and net.core.gso.ipv6=0. Restrict nested tunneling protocols in network configurations. Monitor kernel logs for signs of exploitation or instability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98853. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart