CVE-2026-53091

A flaw was found in the Linux kernel's handling of Generic Segmentation Offload (GSO) packet headers. This vulnerability occurs when the qdisc_pkt_len_segs_init() function does not properly pull headers into the expected memory location, which can lead to incorrect processing by network drivers. A remote attacker could exploit this by sending specially crafted malicious packets, potentially causing a denial of service (DoS) or other unexpected system behavior.

This flaw is rated as Important severity because a local user capable of generating malformed network packets can cause out-of-bounds kernel memory operations, threatening system availability and stability. The Linux kernel's queueing discipline subsystem does not ensure that generic segmentation offload headers are pulled into linear buffer space prior to driver transmission. Consequently, network driver offload routines may access invalid memory buffers, leading directly to a kernel panic or localized memory corruption under standard enterprise network configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.