CVE-2026-98557

A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by transmitting network traffic that uses User Datagram Protocol (UDP) Generic Segmentation Offload (GSO). Because the driver improperly attempts to read Transmission Control Protocol (TCP) headers on UDP packets, it miscalculates packet header lengths and can submit oversized packet segments to the network device, leading to transmission failures or device stalls.

This vulnerability is rated as having Moderate impact because exploitation requires local access and is constrained to systems configured with Google Virtual NIC devices, limiting the blast radius to a denial of service. The flaw only manifests in environments utilizing the gve network driver, typically virtual machines running on Google Cloud Platform. Because an attacker can at most disrupt network interface traffic without breaching system integrity or exfiltrating data, the risk does not reach a higher severity level.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.