CVE-2026-53235

A flaw was found in the Linux kernel's network Generic Receive Offload (GRO) handling. An attacker sending specially crafted network packets could trigger a bug in the skb_gro_receive_list() function. This occurs when the system attempts to process network data that is not in the expected linear memory area, leading to an incorrect buffer length calculation. The flaw can cause a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because an attacker can trigger a kernel panic resulting in a denial of service, but cannot compromise system confidentiality or integrity. Older enterprise releases including Red Hat Enterprise Linux 8 and 9 do not contain the affected networking logic and remain unaffected. On impacted systems, exploitation requires specific fragmented network traffic that causes an assertion failure during generic receive offload aggregation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.