CVE-2026-98556 Overview
CVE-2026-98556 affects the Linux kernel gve (Google Virtual Ethernet) driver, specifically the DQO queue format transmit path. The gve_prep_tso() function fails to enforce the device requirement that TCP Segmentation Offload (TSO) Maximum Segment Size (MSS) remain at or below 9728 bytes. The driver assumes the 9K Maximum Transmission Unit (MTU) and the 64KB TSO size limit are sufficient guardrails. That assumption breaks for packets originating outside the local stack, such as those from guests behind a tap device or from packet socket users supplying an arbitrary gso_size in virtio_net_hdr.
Critical Impact
An unprivileged guest or packet socket user can submit a GSO packet with an oversized gso_size, causing silent truncation in the 14-bit MSS field of the TSO context descriptor and producing malformed transmit descriptors on Google Cloud gve interfaces.
Affected Products
- Linux kernel gve driver (DQO queue format transmit path)
- Google Compute Engine virtual network interfaces using gve
- Linux-based guests and hosts forwarding GSO packets through gve NICs
Discovery Timeline
- 2026-10-18 - CVE-2026-98556 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98556
Vulnerability Analysis
The flaw sits in the DQO transmit path of the gve driver. gve_prep_tso() documents the hardware constraint that MSS must be <= 9728 but never validates the value before descriptor construction. Normal locally generated TSO traffic stays within bounds because the hypervisor enforces a 9K MTU and the stack caps TSO size at 64KB.
Forwarded and injected packets bypass these safeguards. Layer 2 forwarding skips the MTU check for GSO packets through is_skb_forwardable(), and gso_features_check() validates only skb->len and gso_segs, never gso_size. A packet with an attacker-controlled gso_size of 16384 reaches gve_tx_fill_tso_ctx_desc() and is written into the 14-bit MSS field, which silently truncates the value to zero.
This is an input validation error [CWE-20] combined with a numeric truncation condition in a hardware descriptor field. The result is a malformed TSO context descriptor delivered to the device, with potential consequences ranging from transmit queue stalls to broader network path disruption.
Root Cause
The root cause is missing bounds enforcement on gso_size in gve_prep_tso() and the absence of GSO-feature gating in gve_features_check_dqo(). The driver trusted upstream kernel checks that do not actually constrain gso_size for forwarded or injected packets.
Attack Vector
A guest behind a tap device, or any local user with AF_PACKET access, can craft a packet with an arbitrary gso_size field in virtio_net_hdr. When that packet traverses a bridge or forwarding path to a gve DQO interface, the oversized MSS reaches the device descriptor and is truncated. Exploitation requires the ability to inject GSO packets into the forwarding path toward a gve-backed NIC. See the upstream fixes in Linux Kernel Commit 296c83b, Linux Kernel Commit 2dc3ae3, and Linux Kernel Commit c517e87.
No verified exploitation code is available. The vulnerability is described in prose based on upstream commit messages.
Detection Methods for CVE-2026-98556
Indicators of Compromise
- Transmit queue errors, resets, or stalls on gve DQO interfaces in dmesg or ethtool -S counters
- Unexpected drops of large forwarded GSO packets on Google Compute Engine instances acting as routers or hypervisors
- Guests or containers emitting virtio_net_hdr with gso_size values greater than 9728 bytes
Detection Strategies
- Audit host kernel versions on Google Compute Engine nodes using the gve driver to confirm whether the fix commits are applied.
- Monitor tcpdump or ethtool -S output on forwarding hosts for anomalous GSO segment sizes delivered to gve-backed NICs.
- Correlate NIC transmit error spikes with workloads that terminate tap devices or run packet socket consumers.
Monitoring Recommendations
- Alert on sustained increases in tx_dropped or driver-level descriptor errors on gve interfaces.
- Track changes to kernel package versions on Linux fleets running on Google Cloud infrastructure.
- Log forwarding paths that bridge untrusted guest traffic to physical gve NICs for later review.
How to Mitigate CVE-2026-98556
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 296c83b, 2dc3ae3, and c517e87 as soon as they land in your distribution.
- Identify Google Compute Engine instances that forward guest or container traffic through gve interfaces and prioritize those hosts for patching.
- Restrict AF_PACKET and CAP_NET_RAW privileges to trusted workloads only.
Patch Information
The fix drops oversized TSO packets in gve_prep_tso() and updates gve_features_check_dqo() to leave GSO bits alone so the stack does not fall back to software segmentation that would produce non-TSO packets larger than 9728 bytes. The patches are available at Linux Kernel Commit 296c83b, Linux Kernel Commit 2dc3ae3, and Linux Kernel Commit c517e87.
Workarounds
- Disable Layer 2 forwarding of untrusted guest traffic directly to gve interfaces where feasible.
- Enforce gso_size validation at the bridge or tap layer using eBPF or tc filters to drop packets with gso_size > 9728.
- Avoid running untrusted workloads with CAP_NET_RAW on hosts whose uplink is a gve NIC until patches are applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
