CVE-2026-98557 Overview
CVE-2026-98557 is a Linux kernel vulnerability in the Google Virtual Ethernet (gve) driver's DQO queue format. The function gve_can_send_tso() incorrectly computes the header length for UDP Generic Segmentation Offload (GSO) packets. It unconditionally calls skb_tcp_all_headers(), which reads the doff field of the TCP header. UDP GSO packets (SKB_GSO_UDP_L4) have no TCP header, so the function reads an arbitrary byte from the UDP payload as the header length. This miscalculation shifts segment boundaries and can push a transmitted packet beyond the GVE_TX_MAX_DATA_DESCS buffer limit.
Critical Impact
The driver may hand the device a GSO packet whose segments span more buffers than the hardware descriptor limit allows, risking transmit path corruption and denial of service on Google Cloud VM network interfaces.
Affected Products
- Linux kernel builds including the gve driver with DQO queue format support
- Google Cloud Compute Engine virtual machines using the gVNIC network interface
- Distribution kernels prior to the fix commits 83769c2, dc9e896, and feab388
Discovery Timeline
- 2026-10-18 - CVE-2026-98557 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98557
Vulnerability Analysis
The gve driver's DQO transmit path uses gve_can_send_tso() to determine how many descriptors each segment of a GSO packet will occupy. This calculation depends on an accurate header length because the device replicates headers in front of every segment.
For TCP Segmentation Offload the driver relies on skb_tcp_all_headers(), which inspects the TCP data offset (doff) field. When the packet is marked SKB_GSO_UDP_L4, no TCP header exists at the transport offset. The call to tcp_hdrlen() reads one byte of UDP payload and treats it as a TCP doff value, producing a header length anywhere from 0 to 60 bytes. This value does not match what gve_prep_tso() programs into the TSO context descriptor, which uses the transport offset plus the eight-byte UDP header.
The mismatch causes two failure modes. Overestimating the per-segment buffer count forces gve_features_check_dqo() to disable GSO, pushing segmentation back onto the kernel. Underestimating allows the driver to submit a packet whose segments exceed GVE_TX_MAX_DATA_DESCS, violating a device contract.
Root Cause
The root cause is an input validation error in protocol handling. gve_can_send_tso() assumes every GSO packet carries a TCP header and does not branch on the GSO type flag. UDP L4 GSO (SKB_GSO_UDP_L4) was not accounted for in the header length computation.
Attack Vector
Triggering the condition requires transmitting UDP GSO traffic through a gve DQO queue. No remote exploitation primitive has been published. The practical impact is a transmit-side malfunction rather than memory corruption, and no public exploit is available. See the fix in Kernel Git Commit 83769c2 for the exact code change.
Detection Methods for CVE-2026-98557
Indicators of Compromise
- Transmit queue stalls or driver errors logged by the gve module on Google Cloud VMs during UDP workloads
- Unexpected GSO offload fallback to software segmentation for UDP traffic, visible as higher CPU usage during large UDP sends
- Kernel warnings referencing exceeded GVE_TX_MAX_DATA_DESCS descriptor counts
Detection Strategies
- Inventory running kernel versions on Google Cloud Compute Engine instances and compare against the fix commits 83769c2, dc9e896, and feab388
- Monitor ethtool -S counters on gve interfaces for anomalous TX drops or TSO failure counts
- Correlate UDP GSO workload events (QUIC, GRO forwarding, UDP tunneling) with transmit errors
Monitoring Recommendations
- Alert on dmesg entries from the gve driver reporting descriptor limit violations
- Track NIC transmit error rates for workloads using QUIC, WireGuard, or other UDP-heavy protocols
- Centralize kernel telemetry from cloud VMs into a security data lake for cross-fleet version drift analysis
How to Mitigate CVE-2026-98557
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 83769c2, dc9e896, and feab388 on all affected hosts
- Prioritize patching of Google Cloud VM images and golden images used for autoscaled fleets
- Validate that distribution vendor kernels (Ubuntu, Debian, RHEL, SUSE) include the backport before promoting to production
Patch Information
The upstream fix replaces the unconditional skb_tcp_all_headers() call with logic that uses the UDP header length for SKB_GSO_UDP_L4 packets, aligning gve_can_send_tso() with what gve_prep_tso() programs into the TSO context descriptor. Patch references: Kernel Git Commit 83769c2, Kernel Git Commit dc9e896, and Kernel Git Commit feab388.
Workarounds
- Disable UDP GSO on affected interfaces using ethtool -K <iface> tx-udp-segmentation off until a patched kernel is deployed
- Avoid workloads that generate large UDP GSO packets (such as QUIC with large send buffers) on unpatched hosts
- Fall back to the GQI queue format where feasible if DQO is not required for performance
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
