Cloudanix VulnDB

CVE-2026-80793

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux network code can make the entire system freeze when it tries to split up certain network packets that are too small.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

ip_do_fragment() enters an infinite loop emitting zero-length fragments when effective MTU is smaller than IPv4 header plus 8 bytes, preventing forward progress of state->left, state->ptr and state->offset until the softlockup watchdog fires.

Why it matters to the business

Network processing on affected Linux systems halts, causing loss of connectivity, service outages, and potential cascading failures for any workloads relying on IPv4 forwarding or fragmentation.

How an attack unfolds

An attacker installs a route with an artificially low MTU (for example via 'mtu lock 20') or forwards IPv4 packets toward a network interface whose MTU is smaller than the minimum required for fragmentation; the kernel repeatedly transmits header-only fragments, exhausting CPU until the softlockup detector triggers a system hang.

How to fix it

Upgrade to a Linux kernel containing the fix that rejects MTU values smaller than hlen + 8 with -EMSGSIZE in ip_do_fragment(); apply the patch that adds the explicit size check before calling ip_frag_next().

How to confirm the fix worked

Confirm the presence of the MTU guard clause in ip_do_fragment(); reproduce the original trigger with an MTU of 20 and verify that -EMSGSIZE is returned instead of an infinite loop.

Typical attack path

  1. Identify or create a route or interface with MTU smaller than hlen + 8
  2. Send or forward an IPv4 packet requiring fragmentation over that path
  3. ip_do_fragment() computes a zero-length payload and loops indefinitely
  4. Softlockup watchdog fires, rendering the system unresponsive

How to detect it

Search kernel logs for softlockup or watchdog messages that reference ip_do_fragment, ip_frag_next, or IPv4 fragmentation; correlate with routes or interfaces that have unusually low MTU values.

  • softlockup on CPU
  • ip_do_fragment
  • ip_frag_next
  • mtu lock 20
  • effective MTU smaller than hlen + 8

What your security team should do

  • Prioritize kernel upgrades on all systems performing IPv4 forwarding or exposed to untrusted routes
  • Audit route tables and interface MTU settings for values below 28 bytes
  • Monitor for softlockup reports mentioning ip_do_fragment or ip_frag_next
  • Test the fix in a lab environment using low-MTU routes before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.

Affected packages

Ecosystem Package Introduced Fixed