CVE-2026-80793

A flaw was found in the Linux kernel's IPv4 fragmentation handling. When processing IPv4 packets, if the Maximum Transmission Unit (MTU) is set to an unusually small value, the kernel's fragmentation logic can enter an infinite loop. This loop causes the system to continuously allocate and transmit empty packet headers, leading to a system freeze or crash, effectively a Denial of Service (DoS). A remote attacker could exploit this by sending specially crafted network packets with a small MTU.

IPv4 fragmentation can enter a non progressing loop when ip_do_fragment() receives an effective MTU smaller than the IPv4 header length plus 8 bytes. In that case ip_frag_next() can compute a zero length fragment payload, while the fragmentation state does not advance and the kernel keeps allocating and transmitting header only fragments until a CPU soft lockup occurs. For the CVSS the PR:N is used in the paranoid network scenario because a remote sender does not need authenticated privileges if the vulnerable forwarding route or undersized device MTU already exists. The issue is network reachable only under specific routing or device MTU conditions, such as an MTU around 20, so AC:H is appropriate. Impact is denial of service via CPU soft lockup and possible kernel panic depending on watchdog policy. No confidentiality or integrity impact is indicated because the primitive is a non progressing loop rather than memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.