CVE-2026-23154

What it actually does

Missing SKB_GSO_DODGY flag on frag_list GSO packets after XLAT IPv4/IPv6 translation allows skb_segment_list to process incompletely translated headers, causing protocol inconsistencies and fallback segmentation failures.

Why it matters to the business

Network throughput drops sharply for IPv4 clients behind IPv6-only uplinks or hotspots using protocol translation, degrading service performance until systems are updated.

How an attack unfolds

An attacker with local access sends or forwards GRO packets through bpf_skb_proto_4_to_6 or 6_to_4 helpers; the resulting frag_list skbs lack the DODGY flag, so skb_segment_list produces inconsistent segments that reduce forwarding throughput.

How to fix it

Update the Linux kernel to commit 3e62db1e3140449608975e29e0979cc5f3b1cc07 or later; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm kernel version contains commit 3e62db1e3140449608975e29e0979cc5f3b1cc07; test GSO forwarding under XLAT conditions and verify SKB_GSO_DODGY is set.

Typical attack path

1. Obtain local access to a Linux system performing XLAT translation
2. Generate or forward IPv4/IPv6 translated GRO packets containing frag_list
3. Trigger skb_segment_list path without SKB_GSO_DODGY
4. Observe protocol inconsistencies and throughput reduction

How to detect it

Review kernel logs for GSO segmentation warnings or throughput anomalies on systems using bpf_skb_proto translation; no public exploitation artifacts known.

What your security team should do

• Prioritize kernel updates on systems performing network address translation or hotspot forwarding
• Monitor EPSS trend for any increase in exploit likelihood
• Test performance impact of the fix in lab environments before wide deployment