CVE-2026-100236

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.

This vulnerability is rated as having an Important severity because an unauthenticated remote attacker or guest virtual machine can cause heap memory corruption, leading to a process crash or potential code execution without requiring elevated privileges. The flaw affects environments using Data Plane Development Kit (DPDK) applications where software Generic Segmentation Offload (GSO) processes packets from untrusted network sources or guest interfaces. Workloads that do not utilize software GSO or rely entirely on hardware-based segmentation offloading are not impacted by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not run software GSO (rte_gso_segment / testpmd --enable-gso) on untrusted packets. Size direct_pool larger than the max header (~208 B tunneled). That does not fully cover the short-first-segment over-read.