CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix double aggregation of flush-marked skbs

Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skbgroreceive(), but skbgroreceive_list() lacks the same validation.

As a result, packets marked with NAPIGROCB(skb)->flush may still be re-aggregated.

This allows already-GRO'd packets with existing fraglist to be re-aggregated into a new GRO session, corrupting the fraglist chain structure. When skb_segment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic.

Scenario (Tethering/Device forwarding): 1. Driver: Generated aggregated packet P1 via LRO with fraglist 2. Dev A: Receives aggregated fraglist packet and flush flag set 3. Dev A: Re-enters GRO, skbgroreceivelist() is called 4. Missing flush check allows re-aggregation despite flush flag 5. Fraglist chain becomes corrupted (loops or dangling refs) 6. Dev B: TX path calls skbsegment(), crashes on corrupted frag_list

Root cause in skbsegment(): The check at line ~4891: if (hsize <= 0 && i >= nfrags && skbheadlen(listskb) && (skbheadlen(list_skb) == len || sg)) {

When fraglist is corrupted by double aggregation, when listskb is a NULL pointer from skb->next, skbheadlen(listskb) dereference NULL/corrupted pointers occurs.

Call Trace: skbheadlen(NULL skb) skbsegment tcpgsosegment tcp4gsosegment inetgsosegment skbmacgso_segment __skbgsosegment skbgsosegment validatexmitskb validatexmitskblist schdirectxmit qdiscrestart __qdiscrun qdiscrun nettxaction

Fix: Add NAPIGROCB(skb)->flush validation to the early-return check in skbgroreceivelist(), matching the defensive programming pattern of skbgro_receive().