Home

Description

In the Linux kernel, the following vulnerability has been resolved: net: use skb_header_pointer() for TCPv4 GSO frag_off check Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1]. gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths. Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying. [1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407

PUBLISHED Reserved 2026-05-01 | Published 2026-05-01 | Updated 2026-05-01 | Assigner Linux

Product status

Default status
unaffected

cbc53e08a793b073e79f42ca33f1f3568703540d (git) before f7a6cd508e9e825a2c69fa9e13d41ee156852f25
affected

cbc53e08a793b073e79f42ca33f1f3568703540d (git) before cc91202fc20a44aab4c206f12a2bfe05da936051
affected

cbc53e08a793b073e79f42ca33f1f3568703540d (git) before d970341cfa5594614c7a6634886c7688b4f5cafd
affected

cbc53e08a793b073e79f42ca33f1f3568703540d (git) before ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0
affected

Default status
affected

4.7
affected

Any version before 4.7
unaffected

6.12.81 (semver)
unaffected

6.18.22 (semver)
unaffected

6.19.12 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/f7a6cd508e9e825a2c69fa9e13d41ee156852f25

git.kernel.org/...c/cc91202fc20a44aab4c206f12a2bfe05da936051

git.kernel.org/...c/d970341cfa5594614c7a6634886c7688b4f5cafd

git.kernel.org/...c/ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0

cve.org (CVE-2026-43036)

nvd.nist.gov (CVE-2026-43036)

Download JSON