CVE-2026-53091 Overview
CVE-2026-53091 is a Linux kernel networking vulnerability in the qdisc_pkt_len_segs_init() function. The flaw allows malicious or malformed Generic Segmentation Offload (GSO) packets to bypass header validation expected by ndo_start_xmit() driver methods. Most network drivers require GSO packet headers to be present in skb->head before transmission, and net/core/tso.c users are particularly exposed because tso_build_hdr() performs a memcpy(hdr, skb->data, hdr_len) operation. The kernel patch replaces skb_header_pointer() with pskb_may_pull() to ensure drivers receive properly linearized headers, and introduces a new SKB_DROP_REASON_SKB_BAD_GSO drop reason for early detection of malicious packets.
Critical Impact
Malicious GSO packets can reach network drivers without proper header validation, potentially triggering memory corruption or instability in TSO (TCP Segmentation Offload) code paths within net/core/tso.c.
Affected Products
- Linux kernel networking stack (net/core/tso.c and qdisc layer)
- Network drivers implementing ndo_start_xmit() with GSO support
- Systems using TCP Segmentation Offload (TSO) functionality
Discovery Timeline
- 2026-06-24 - CVE-2026-53091 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53091
Vulnerability Analysis
The vulnerability resides in the Linux kernel queueing discipline (qdisc) layer, specifically in qdisc_pkt_len_segs_init(). This function dissects GSO packets to compute segment lengths but did not guarantee that packet headers were linearized into skb->head before subsequent driver code accessed them.
Most ndo_start_xmit() methods assume GSO packet headers are already pulled into the linear data area of the socket buffer (skb). When this assumption fails, drivers using TCP Segmentation Offload via net/core/tso.c can dereference invalid memory. The tso_build_hdr() function performs a direct memcpy(hdr, skb->data, hdr_len) against skb->data, which is unsafe when headers reside in paged fragments rather than the linear buffer.
The fix replaces skb_header_pointer() with pskb_may_pull() to force header linearization, and adds the SKB_DROP_REASON_SKB_BAD_GSO drop reason to identify and discard malformed GSO packets early in the pipeline.
Root Cause
The root cause is an unsafe assumption about socket buffer layout. skb_header_pointer() returns a pointer that may reference a temporary buffer, but does not guarantee that the headers are present in skb->head for downstream consumers. Drivers reimplementing this check were a maintenance burden and a source of inconsistency.
Attack Vector
An attacker capable of injecting crafted GSO packets into the network stack can exercise the unsafe code path. The vulnerability is classified as a kernel-level packet handling flaw, with the exact attack surface depending on whether GSO packets can be received from untrusted sources such as virtual machines, containers, or external network peers forwarding GSO traffic.
No verified exploit code is publicly available. The vulnerability is described in the upstream kernel commits referenced by the Linux stable tree commit 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 and Linux stable tree commit 9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a.
Detection Methods for CVE-2026-53091
Indicators of Compromise
- Kernel log messages referencing SKB_DROP_REASON_SKB_BAD_GSO indicating malformed GSO packets dropped at the qdisc layer.
- Unexpected kernel oops or panic traces involving qdisc_pkt_len_segs_init(), tso_build_hdr(), or ndo_start_xmit() call paths.
- Abnormal volumes of malformed GSO traffic originating from guest VMs, containers, or virtual interfaces.
Detection Strategies
- Monitor /proc/net/netstat and nstat counters for unusual SkbDropReason increments after applying the patch.
- Enable kernel tracepoints such as kfree_skb with the drop_reason field to observe SKB_DROP_REASON_SKB_BAD_GSO events in real time.
- Audit installed kernel versions across fleet hosts to identify unpatched systems running GSO-enabled workloads.
Monitoring Recommendations
- Forward kernel logs and kfree_skb tracepoint events into a centralized logging or SIEM platform for correlation.
- Establish baselines for GSO drop counters on hypervisors and container hosts where guest-controlled traffic transits.
- Alert on kernel crashes or repeated soft lockups in networking code paths on systems with high GSO throughput.
How to Mitigate CVE-2026-53091
Immediate Actions Required
- Identify Linux hosts running kernel versions prior to the fix in commits 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 and 9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a.
- Apply the latest stable kernel update from your distribution vendor that incorporates the qdisc header pull fix.
- Restrict the ability of untrusted guests or containers to inject raw GSO packets onto host network interfaces.
Patch Information
The upstream fix is available in the Linux stable tree. Review the Linux kernel commit 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 and Linux kernel commit 9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a for the exact changes. Distribution vendors typically backport such fixes into long-term support kernels.
Workarounds
- Disable TCP Segmentation Offload on affected interfaces using ethtool -K <iface> tso off gso off where operationally feasible.
- Apply ingress filtering on bridges and virtual switches to drop malformed packets before they reach the host qdisc layer.
- Restrict CAP_NET_RAW and CAP_NET_ADMIN capabilities for untrusted workloads to limit raw packet injection.
# Configuration example: disable GSO/TSO on a network interface as a temporary workaround
ethtool -K eth0 tso off
ethtool -K eth0 gso off
ethtool -K eth0 gro off
# Verify offload settings
ethtool -k eth0 | grep -E 'tcp-segmentation|generic-segmentation|generic-receive'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
