CVE-2026-80725

A flaw was found in the Linux kernel’s Generic Receive Offload (GRO) component, which handles network packet aggregation. Improper validation of BIG TCP aggregation criteria allows a remote attacker to send specially crafted network frames. This can lead to an out-of-bounds write when processing IPv6 packets, potentially causing a system crash (denial of service) or other unpredictable behavior.

BIG TCP GRO aggregation can incorrectly accept IPv6 aggregates above the legacy 64 KB GRO limit without fully validating the protocol, encapsulation state, and actual space available before the MAC header. In the affected code, skb_gro_receive() checks skb_headroom(p) rather than the position of p->mac_header. Because skb_headroom() also includes the MAC header length, the check can succeed even when less than the required space is available before the MAC header.

When such an IPv6 TCP aggregate is completed, ipv6_gro_complete() may attempt to insert the temporary Hop-by-Hop jumbo header used by the affected BIG TCP receive implementation. If p->mac_header is smaller than the required jumbo-header size, the associated memmove() can start before skb->head, resulting in a kernel out-of-bounds write and corruption of skb metadata. The affected GRO logic also did not correctly reject some encapsulated traffic because it relied on p->encapsulation without checking the receive-side encap_mark.

The vulnerable path is specific to BIG TCP receive aggregation. Ordinary GRO operation within the legacy 64 KB limit does not by itself reach this condition. In practice, the receiving interface must permit GRO aggregates larger than 64 KB, such as through a gro_max_size value above 65536. BIG TCP is a specialized high-throughput networking optimization and is normally not enabled by default, substantially limiting practical exposure compared with ordinary GRO-enabled systems. Disabling BIG TCP or limiting GRO aggregation to 64 KB or less prevents the affected oversized-aggregation path from being reached.

Crafted frame injection through mechanisms such as AF_PACKET provides a reliable way to control the packet layout and trigger the vulnerable condition locally. However, on an affected system with BIG TCP receive aggregation enabled, the vulnerable code also lies on the network receive GRO path. A remote or network-adjacent sender may therefore be able to cause an IPv6 TCP flow to be aggregated beyond 64 KB without requiring a local account. For the paranoid CVSS assessment, PR:N reflects this network-receive exposure. Practical exploitability nevertheless depends on the BIG TCP configuration and on reaching the specific skb layout that allows the invalid jumbo-header insertion.

The confirmed primitive is a kernel out-of-bounds write rather than a NULL-pointer dereference, resource exhaustion, or simple packet-processing failure. The directly supported impact is at least denial of service through kernel memory corruption and a possible kernel crash. Because the write occurs outside the valid skb allocation boundary, corruption of adjacent kernel memory may potentially have integrity or confidentiality consequences under favorable memory-layout conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable Generic Receive Offload (GRO) on network interfaces to prevent aggregation of incoming frames beyond legacy size limits.

To disable GRO immediately on a network interface:

ethtool -K <interface> gro off

Caveats: Disabling GRO can reduce TCP receive throughput and increase CPU load under high network traffic. This change takes effect immediately without restarting network services, but it does not persist across system reboots unless added to interface configuration scripts.