CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: gro: fix double aggregation of flush-marked skbs<br /> <br /> Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO<br /> packet.") added a flush check to skb_gro_receive(), but<br /> skb_gro_receive_list() lacks the same validation.<br /> <br /> As a result, packets marked with NAPI_GRO_CB(skb)-&gt;flush may still be<br /> re-aggregated.<br /> <br /> This allows already-GRO&amp;#39;d packets with existing frag_list to be<br /> re-aggregated into a new GRO session, corrupting the frag_list chain<br /> structure. When skb_segment() attempts to unpack these malformed packets,<br /> it encounters invalid state and triggers a kernel panic.<br /> <br /> Scenario (Tethering/Device forwarding):<br /> 1. Driver: Generated aggregated packet P1 via LRO with frag_list<br /> 2. Dev A: Receives aggregated fraglist packet and flush flag set<br /> 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called<br /> 4. Missing flush check allows re-aggregation despite flush flag<br /> 5. Frag_list chain becomes corrupted (loops or dangling refs)<br /> 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list<br /> <br /> Root cause in skb_segment():<br /> The check at line ~4891:<br /> if (hsize = nfrags &amp;&amp; skb_headlen(list_skb) &amp;&amp;<br /> (skb_headlen(list_skb) == len || sg)) {<br /> <br /> When frag_list is corrupted by double aggregation, when list_skb is<br /> a NULL pointer from skb-&gt;next, skb_headlen(list_skb) dereference<br /> NULL/corrupted pointers occurs.<br /> <br /> Call Trace:<br /> skb_headlen(NULL skb)<br /> skb_segment<br /> tcp_gso_segment<br /> tcp4_gso_segment<br /> inet_gso_segment<br /> skb_mac_gso_segment<br /> __skb_gso_segment<br /> skb_gso_segment<br /> validate_xmit_skb<br /> validate_xmit_skb_list<br /> sch_direct_xmit<br /> qdisc_restart<br /> __qdisc_run<br /> qdisc_run<br /> net_tx_action<br /> <br /> Fix: Add NAPI_GRO_CB(skb)-&gt;flush validation to the early-return check in<br /> skb_gro_receive_list(), matching the defensive programming pattern of<br /> skb_gro_receive().