CVE-2026-53091
- Source
- https://cve.org/CVERecord?id=CVE-2026-53091
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53091.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-53091
- Downstream
- Published
- 2026-06-24T16:30:30.290Z
- Modified
- 2026-07-08T08:07:23.539918935Z
- Severity
-
- 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H CVSS Calculator
- Summary
- net: pull headers in qdisc_pkt_len_segs_init()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdiscpktlensegsinit()
Most ndostartxmit() methods expects headers of gso packets to be already in skb->head.
net/core/tso.c users are particularly at risk, because tsobuildhdr() does a memcpy(hdr, skb->data, hdr_len);
qdiscpktlensegsinit() already does a dissection of gso packets.
Use pskbmaypull() instead of skbheaderpointer() to make sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKBDROPREASONSKBBADGSO dropreason.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53091.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4
- https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json
- https://access.redhat.com/security/cve/CVE-2026-53091
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53091.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-53091
- https://bugzilla.redhat.com/show_bug.cgi?id=2492270
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git