Cloudanix VulnDB

CVE-2026-80725

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Aug 29, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel combines large network packets can let attackers corrupt memory and take over the system by sending specially crafted traffic.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in skb_gro_receive() during BIG TCP aggregation when MAC header space is insufficient or non-TCP/IP or encapsulated flows are processed, caused by checking skb_headroom instead of mac_header offset and incorrect protocol/encapsulation flags.

Why it matters to the business

Remote attackers can trigger kernel memory corruption on affected Linux systems, potentially leading to crashes, privilege escalation, or full system compromise via network traffic without authentication.

How an attack unfolds

An attacker crafts IPv4/IPv6 TCP or non-IP frames (including via AF_PACKET injection or encapsulated tunnels like SIT) that pass flawed checks in skb_gro_receive(), allowing aggregation beyond 64KB; on IPv6 this triggers memmove before skb->head, corrupting mac_header and enabling OOB write.

How to fix it

Apply the backported fix from commit b1a78b9b9886 reversal to older stable kernels (6.18.y and similar); upgrade to mainline 7.0+ where the subsystem rewrite eliminates the flaw; ensure NAPI_GRO_CB checks for proto==TCP, no encap_mark, and sufficient mac_header for IPv6.

How to confirm the fix worked

Confirm kernel source contains the strict checks for NAPI_GRO_CB(skb)->proto, !encap_mark, ETH_P_IP/ETH_P_IPV6, and mac_header >= sizeof(hop_jumbo_hdr) before any aggregation >64KB; test with crafted AF_PACKET frames that previously triggered OOB.

Typical attack path

  1. Send or inject packets matching flawed aggregation criteria (wrong headroom, non-TCP, or encapsulated)
  2. Trigger GRO aggregation path in skb_gro_receive() exceeding GRO_LEGACY_MAX_SIZE
  3. Cause memmove to start before skb->head on IPv6 HBH insertion
  4. Corrupt skb metadata and achieve memory write primitive or crash

How to detect it

Inspect kernel logs for skb_gro_receive errors or OOB warnings, netif_receive_skb traces involving packets >64KB with ETH_P_8021Q/AD or encapsulation flags, and AF_PACKET usage on interfaces; review crash dumps showing mac_header wrap or memmove before head.

  • skb_gro_receive.*E2BIG
  • memmove.*mac_header
  • NAPI_GRO_CB.*encap_mark
  • ETH_P_8021Q.*GRO

What your security team should do

  • Prioritize patching all systems running affected 6.18.y or older stable kernels within the next 30 days
  • Disable BIG TCP or GRO where possible on exposed interfaces until patched
  • Monitor network-facing hosts for unexpected crashes in GRO paths

The record

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP (with sufficient MAC header room to insert the temporary HBH jumbo header). However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp") loosened the check in skb_gro_receive(), leading to several issues: 1. skb_gro_receive() checked skb_headroom(p) instead of the actual space before the MAC header (p->mac_header). Because skb_headroom(p) includes mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the temporary HBH jumbo header, the memmove() starts before skb->head, causing an out-of-bounds write and wrapping skb->mac_header. 2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q / ETH_P_8021AD) to aggregate beyond 64KB because p->protocol != ETH_P_IPV6 was true. 3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark, allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate beyond 64KB. Fix skb_gro_receive() to strictly enforce: - NAPI_GRO_CB(skb)->proto == IPPROTO_TCP - Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation) - Protocol must be either ETH_P_IP or ETH_P_IPV6 - If ETH_P_IPV6, p->mac_header must be at least sizeof(struct hop_jumbo_hdr) Returning -E2BIG from skb_gro_receive() ensures that packets which cannot become BIG TCP are cleanly flushed at <= 64KB and delivered intact without dropping. This issue does not exist in mainline (7.0+) because the subsystem was rewritten in commit 81be30c1f5f2 ("net/ipv6: Drop HBH for BIG TCP on RX side"), making this fix relevant only for older stable branches like 6.18.y.

Affected packages

Ecosystem Package Introduced Fixed