CVE-2023-54051

A NULL pointer dereference vulnerability was found in the Linux kernel's networking stack. The virtio_net_hdr_to_skb() function lacks validation to prevent gso_size from being set to GSO_BY_FRAGS (0xffff), a magic value used internally by the kernel. When userspace provides this value, it causes skb_segment() to dereference a NULL pointer during GSO (Generic Segmentation Offload) processing.

This flaw was discovered by syzbot and can be triggered from userspace via packet sockets (AF_PACKET). An unprivileged user with CAP_NET_RAW capability or access to packet sockets can craft a malicious packet with gso_size set to 0xffff to crash the kernel during packet transmission.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.