CVE-2026-68136: Linux Kernel GRO DOS Vulnerability

CVE-2026-68136 Overview

CVE-2026-68136 is a Linux kernel vulnerability in the Generic Receive Offload (GRO) subsystem. The flaw affects skb_gro_receive_list(), which lacks a flush-flag validation present in the sibling function skb_gro_receive(). Packets marked with NAPI_GRO_CB(skb)->flush can be re-aggregated into a new GRO session, corrupting the frag_list chain. When the transmit path later invokes skb_segment(), the corrupted list dereferences a NULL or invalid pointer and triggers a kernel panic. The condition is reachable over the network on tethering and device-forwarding paths where Large Receive Offload (LRO) generates fraglist packets.

Critical Impact
Remote network traffic can corrupt kernel socket buffer chains and crash the Linux kernel, producing a denial-of-service condition on forwarding hosts.

Affected Products

Linux kernel (upstream), pre-patch versions of the net/core/skbuff.c GRO path
Distributions shipping the affected skb_gro_receive_list() code
Systems performing GRO on LRO-generated fraglist packets (tethering, routing, forwarding)

Discovery Timeline

2026-08-10 - CVE-2026-68136 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68136

Vulnerability Analysis

Generic Receive Offload aggregates incoming packets in the network stack to reduce per-packet processing costs. Commit 0ab03f353d36 added a flush check to skb_gro_receive() so that packets carrying the flush marker skip aggregation. The parallel routine skb_gro_receive_list(), which handles fraglist-style aggregation, did not receive the same guard.

An attacker-controlled or hostile network stream can drive a receiving device into a state where an already-aggregated packet with an existing frag_list re-enters the GRO path with the flush flag set. Without the flush check, skb_gro_receive_list() chains the flush-marked skb into another aggregation, producing loops or dangling references in frag_list.

On transmit, skb_segment() walks the corrupted chain. The check near line 4891 relies on skb_headlen(list_skb), and a NULL list_skb from skb->next causes a NULL pointer dereference inside skb_headlen. The observed call trace traverses tcp_gso_segment, inet_gso_segment, __skb_gso_segment, validate_xmit_skb, and __qdisc_run before crashing.

Root Cause

The defect is a missing input validation check [CWE-20] in skb_gro_receive_list(). The early-return path does not verify NAPI_GRO_CB(skb)->flush, allowing packets already marked for flush to be aggregated a second time.

Attack Vector

The attack vector is network-adjacent traffic that a vulnerable host receives and forwards. Scenarios include tethering setups where a driver produces LRO fraglist packets, Device A ingests and re-enters GRO, and Device B later segments the corrupted skb on transmit. No authentication is required to reach the vulnerable code path.

The vulnerability is described in prose because no proof-of-concept exploit code has been published. See the upstream commits listed in Linux Kernel Commit 107e1a4 and Linux Kernel Commit fc0c0f7 for the exact source-level change.

Detection Methods for CVE-2026-68136

Indicators of Compromise

Kernel oops or panic messages referencing skb_headlen, skb_segment, tcp_gso_segment, or validate_xmit_skb in dmesg and /var/log/kern.log.
Unexpected reboots on Linux forwarding, routing, or tethering hosts under normal network load.
NULL pointer dereference traces originating from the net_tx_action softirq path.

Detection Strategies

Correlate kernel crash dumps with the specific call chain (skb_segment -> tcp_gso_segment -> inet_gso_segment) to distinguish this issue from unrelated kernel faults.
Inventory hosts running unpatched kernels that also enable LRO on network interfaces, since these devices are most exposed to fraglist corruption.
Monitor telemetry for repeated soft-lockup or panic events on identical kernel builds to identify systemic exposure.

Monitoring Recommendations

Ship kernel logs to a centralized log store and alert on BUG:, Oops:, and general protection fault strings tied to GRO functions.
Track network interface counters for unusual GSO segmentation failures and TX drops that may precede a crash.
Enable kdump on production hosts so post-crash analysis can confirm whether the fault matches the CVE-2026-68136 signature.

How to Mitigate CVE-2026-68136

Immediate Actions Required

Apply the upstream Linux kernel fix that adds NAPI_GRO_CB(skb)->flush validation to skb_gro_receive_list().
Reboot affected hosts into the patched kernel after installation to ensure the vulnerable code path is replaced.
Prioritize routers, gateways, tethering devices, and any host performing GRO on LRO-generated traffic.

Patch Information

The fix adds the missing flush check to skb_gro_receive_list(), matching the defensive pattern already used in skb_gro_receive(). The stable-tree commits are available at Linux Kernel Commit 107e1a4, Linux Kernel Commit a4dfd46, Linux Kernel Commit e751256, and Linux Kernel Commit fc0c0f7. Consume vendor kernel updates from your Linux distribution once they incorporate these commits.

Workarounds

Disable LRO on network interfaces that feed the GRO path using ethtool -K <iface> lro off, removing the fraglist input that triggers re-aggregation.
Disable GRO where feasible with ethtool -K <iface> gro off, accepting the performance cost until the kernel is patched.
Restrict the host from acting as a forwarder by setting net.ipv4.ip_forward=0 where forwarding is not required.

bash

# Configuration example: disable LRO and GRO on the affected interface
sudo ethtool -K eth0 lro off
sudo ethtool -K eth0 gro off

# Verify the offload state
ethtool -k eth0 | grep -E 'large-receive-offload|generic-receive-offload'