CVE-2026-53235

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: add pskb_may_pull() to skb_gro_receive_list()<br /> <br /> skb_gro_receive_list() calls skb_pull(skb, skb_gro_offset(skb)) without<br /> first ensuring the data is in the linear area via pskb_may_pull(). When<br /> the skb arrives via napi_gro_frags(), skb_headlen can be 0 (all data in<br /> page fragments) while skb_gro_offset is non-zero (after IP+TCP header<br /> parsing). The skb_pull() then decrements skb-&gt;len by skb_gro_offset<br /> but skb-&gt;data_len stays unchanged, hitting BUG_ON(skb-&gt;len data_len)<br /> in __skb_pull().<br /> <br /> The UDP fraglist GRO path already contains this guard at<br /> udp_offload.c:749. Adding it to skb_gro_receive_list() itself provides<br /> centralized protection for all callers (TCP, UDP, and any future<br /> protocols), and ensures the precondition of skb_pull() is satisfied<br /> before it is called.<br /> <br /> On pskb_may_pull() failure, set NAPI_GRO_CB(skb)-&gt;flush = 1 so the<br /> skb is not held as a new GRO head and is instead delivered through the<br /> normal receive path, matching the UDP handling.