CVE-2026-80725: Linux Kernel BIG TCP Buffer Overflow

CVE-2026-80725 Overview

CVE-2026-80725 is a Linux kernel vulnerability in the Generic Receive Offload (GRO) subsystem. The flaw stems from insufficient validation of BIG TCP aggregation criteria in skb_gro_receive(). Attackers can craft frames via AF_PACKET that pass a loose headroom check, triggering an out-of-bounds write when ipv6_gro_complete() inserts a temporary Hop-by-Hop (HBH) jumbo header. The memmove() operation begins before skb->head, wrapping skb->mac_header and corrupting adjacent memory. The issue affects older stable branches such as 6.18.y and does not exist in mainline 7.0+ due to a subsystem rewrite.

Critical Impact
Local attackers with AF_PACKET access can trigger kernel memory corruption through crafted GRO-eligible frames, potentially leading to denial of service or privilege escalation.

Affected Products

Linux kernel stable branch 6.18.y (and other pre-7.0 branches inheriting commit b1a78b9b9886)
Systems with GRO and BIG TCP enabled on network interfaces
Kernels processing IPv6 traffic through the GRO aggregation path

Discovery Timeline

2026-08-29 - CVE-2026-80725 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80725

Vulnerability Analysis

The vulnerability resides in skb_gro_receive() within the Linux networking stack. BIG TCP allows GRO to aggregate packets beyond the GRO_LEGACY_MAX_SIZE of 64KB. This aggregation should only apply to plain IPv4 TCP and plain IPv6 TCP flows with adequate MAC header room for a temporary HBH jumbo header.

Commit b1a78b9b9886 ("net: add support for ipv4 big tcp") relaxed the validation logic, introducing three distinct issues. First, the check used skb_headroom(p) instead of the space before p->mac_header. Because skb_headroom(p) includes mac_len, crafted frames can pass the check when p->mac_header is less than 8 bytes. Second, the check permitted non-IP protocols such as software VLAN (ETH_P_8021Q and ETH_P_8021AD) to aggregate beyond 64KB. Third, the code evaluated p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark, allowing encapsulated flows such as SIT (IPv6-in-IPv4) to bypass the size limit.

Root Cause

The root cause is improper input validation of GRO aggregation preconditions. The header space check used the wrong offset calculation, and protocol and encapsulation checks did not enforce the intended constraints. This is an out-of-bounds write [CWE-787] triggered by insufficient boundary validation.

Attack Vector

An attacker with the ability to inject raw frames, for example via AF_PACKET, can craft packets that satisfy the loose validation but leave insufficient headroom before mac_header. When ipv6_gro_complete() later inserts the HBH jumbo header, the memmove() writes before skb->head, corrupting kernel memory and wrapping skb->mac_header. See the kernel commit 37a5dcd6837f for the corrective patch details.

Detection Methods for CVE-2026-80725

Indicators of Compromise

Kernel oops or panic messages referencing skb_gro_receive, ipv6_gro_complete, or memmove in network softirq context
Unexpected skb->mac_header wrap-around values observed in kernel crash dumps
Anomalous use of AF_PACKET raw sockets by non-privileged or unexpected processes

Detection Strategies

Audit processes that open AF_PACKET sockets and correlate against expected system baselines
Monitor kernel logs (dmesg, journalctl -k) for GRO-related warnings, slab corruption reports, or KASAN alerts on affected hosts
Track kernel version inventory against known-vulnerable stable branches such as 6.18.y

Monitoring Recommendations

Enable KASAN in test and pre-production kernels to surface out-of-bounds writes during fuzzing
Collect network softirq stack traces and forward kernel telemetry to a centralized log store for correlation
Alert on unexpected NIC feature changes involving GRO or BIG TCP (ethtool -k) on production hosts

How to Mitigate CVE-2026-80725

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the fix commits and reboot affected hosts
Restrict CAP_NET_RAW and AF_PACKET socket creation to trusted processes only
Inventory kernel versions across the fleet and prioritize hosts running 6.18.y or other affected stable branches

Patch Information

The fix strictly enforces four conditions in skb_gro_receive(): NAPI_GRO_CB(skb)->proto == IPPROTO_TCP, no encapsulation (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation), protocol must be ETH_P_IP or ETH_P_IPV6, and for IPv6, p->mac_header must be at least sizeof(struct hop_jumbo_hdr). Returning -E2BIG ensures packets that cannot become BIG TCP are flushed at or below 64KB. See the stable kernel fixes: 03cb8cc2961f, 37a5dcd6837f, 3ce832e2bd43, and e907bf694ed5. Mainline 7.0+ already resolves this via the subsystem rewrite in commit 81be30c1f5f2.

Workarounds

Disable BIG TCP on affected interfaces using ip link set dev <iface> gro_ipv6_max_size 65536 where supported
Disable GRO on exposed interfaces with ethtool -K <iface> gro off as a temporary measure, accepting the throughput trade-off
Remove CAP_NET_RAW from untrusted workloads and containers to eliminate raw frame injection paths

bash

# Configuration example
# Verify running kernel version
uname -r

# Disable GRO on the interface as a temporary workaround
sudo ethtool -K eth0 gro off

# Reduce IPv6 GRO max size below the BIG TCP threshold
sudo ip link set dev eth0 gro_ipv6_max_size 65536

# Confirm current GRO settings
ethtool -k eth0 | grep -i gro