CVE-2026-80590 Overview
CVE-2026-80590 is a Linux kernel vulnerability in the IP fragment reassembly path (inet_frag_queue_insert()) that allows an unprivileged local user to trigger a kernel panic. The flaw exists because a virtio_net_hdr (from tun/tap or AF_PACKET with PACKET_VNET_HDR) can mark an IPv4 or IPv6 fragment as Generic Segmentation Offload (GSO). Nothing in the fragment queue logic strips this GSO state before reassembly. When the reassembled datagram later reaches a segmentation point such as udp_rcv_segment() or validate_xmit_skb(), skb_segment() walks the frag_list and hits a BUG_ON(), panicking the kernel.
Critical Impact
Two writes to a tap device by an unprivileged user in a user namespace are sufficient to panic the kernel, producing a denial of service condition reachable from guest VMs whose VMM forwards virtio_net_hdr to a tap.
Affected Products
- Linux kernel versions since commit f43798c27684 ("tun: Allow GSO using virtio_net_hdr")
- Any distribution shipping unpatched Linux kernels with tun/tap or AF_PACKETPACKET_VNET_HDR exposed to unprivileged users or user namespaces
- Hypervisor hosts forwarding virtio_net_hdr from guests to a tap interface
Discovery Timeline
- 2026-08-28 - CVE-2026-80590 published to the National Vulnerability Database
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-80590
Vulnerability Analysis
The defect resides in the shared inet fragment reassembly code used by IPv4, IPv6, nf_conntrack_reasm, and 6lowpan. Functions inet_frag_reasm_prepare() and inet_frag_reasm_finish() retain the first fragment's skb as the head of the reassembled datagram, including its shinfo->gso_size, gso_type, and gso_segs. Remaining fragments are chained on frag_list with whatever linear or paged layout they arrived with.
After ip_defrag() completes via ip_local_deliver() or nf_defrag_ipv4, the reassembled skb still advertises itself as GSO with SKB_GSO_DODGY. When it reaches the next software segmentation point, skb_segment() assumes GRO-shaped input and its frag_list walk hits BUG_ON(i >= nfrags) or BUG_ON(!list_skb->head_frag) at net/core/skbuff.c:4899. Because this code runs with bottom halves disabled, the fault escalates to a full kernel panic rather than an oops.
Root Cause
An skb entering a fragment queue is an IP fragment by definition and cannot legitimately carry GSO state. GRO does not merge fragments, and the network stack segments before it fragments. Prior guards added by commits 3dcbdb134f32 and 9e4b7a99a03a do not cover this case: page-backed heads bypass them, and kmalloc heads bypass them when gso_size == skb_headlen(head), both of which the sender controls.
Attack Vector
An unprivileged process opens a tun/tap device inside its own user namespace and writes two crafted packets containing a virtio_net_hdr with GSO metadata attached to an IPv4 or IPv6 fragment. The kernel reassembles the fragments and then attempts to segment the resulting skb, triggering the BUG_ON(). The same path is reachable with CAP_NET_RAW in a network namespace where a defrag hook precedes a GSO point, and from virtual machine guests whose VMM forwards virtio_net_hdr to a host tap interface. The vulnerability has been reachable since commit f43798c27684, the first path that allowed userspace to attach GSO metadata to an IP fragment.
Detection Methods for CVE-2026-80590
Indicators of Compromise
- Kernel panic log entries referencing kernel BUG at net/core/skbuff.c:4899 with skb_segment+ in the call trace
- Call stacks containing __udp_gso_segment, udp4_ufo_fragment, udp6_ufo_fragment, or inet_gso_segment followed by skb_segment
- Repeated host crashes correlated with tun_chr_write_iter, tun_get_user, or tun_rx_batched entries in the trace
Detection Strategies
- Monitor kernel crash dumps and kdump output for the skb_segmentBUG_ON signature described above
- Audit which unprivileged users and containers can open /dev/net/tun or create AF_PACKET sockets with PACKET_VNET_HDR
- Enumerate running kernel versions across the fleet and correlate against the upstream fix commits listed in the references
Monitoring Recommendations
- Forward kernel logs, dmesg output, and crash reports to a centralized logging or SIEM platform to detect the BUG_ON signature at scale
- Track host uptime and unexpected reboots on hypervisors and container hosts that expose tap interfaces to guests or tenants
- Alert on user-namespace creation combined with tun/tap device access by non-root processes
How to Mitigate CVE-2026-80590
Immediate Actions Required
- Apply the upstream Linux kernel patches that reset the GSO fields of every fragment as it is queued in inet_frag_queue_insert()
- Update to distribution kernels that include the fix commits referenced in NVD once released by your Linux vendor
- Restrict access to /dev/net/tun and AF_PACKET with PACKET_VNET_HDR for untrusted users and containers until patched
- Disable unprivileged user namespaces on hosts that do not require them
Patch Information
The fix strips GSO state from fragments before reassembly by clearing shinfo->gso_size, gso_type, and gso_segs in inet_frag_queue_insert(). This ensures neither the head nor the frag_list members of the reassembled skb carry GSO metadata, which also protects the ip_do_fragment() and ip6_fragment() fast paths that forward frag_list members unchanged. Refer to the upstream fixes: Linux Kernel Commit 14a8f3e, Linux Kernel Commit 29dda27, Linux Kernel Commit 3edf721, Linux Kernel Commit 69b73b7, Linux Kernel Commit c49f04e, Linux Kernel Commit cfdbc8c, Linux Kernel Commit d5dc1e6, Linux Kernel Commit da857e4, and Linux Kernel Commit dec2edb.
Workarounds
- Disable unprivileged user namespaces where feasible by setting kernel.unprivileged_userns_clone=0 on hosts that expose tun/tap
- Remove the CAP_NET_ADMIN and CAP_NET_RAW capabilities from untrusted workloads and containers
- Restrict permissions on /dev/net/tun and drop PACKET_VNET_HDR capability for guest-facing hypervisor tap interfaces where possible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
