CVE-2026-80725

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: gro: properly validate BIG TCP aggregation criteria<br /> <br /> When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),<br /> BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP<br /> (with sufficient MAC header room to insert the temporary HBH jumbo header).<br /> <br /> However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp")<br /> loosened the check in skb_gro_receive(), leading to several issues:<br /> <br /> 1. skb_gro_receive() checked skb_headroom(p) instead of the actual space<br /> before the MAC header (p-&gt;mac_header). Because skb_headroom(p) includes<br /> mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check<br /> with p-&gt;mac_header head,<br /> causing an out-of-bounds write and wrapping skb-&gt;mac_header.<br /> 2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /<br /> ETH_P_8021AD) to aggregate beyond 64KB because<br /> p-&gt;protocol != ETH_P_IPV6 was true.<br /> 3. It checked p-&gt;encapsulation instead of NAPI_GRO_CB(skb)-&gt;encap_mark,<br /> allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate<br /> beyond 64KB.<br /> <br /> Fix skb_gro_receive() to strictly enforce:<br /> - NAPI_GRO_CB(skb)-&gt;proto == IPPROTO_TCP<br /> - Not encapsulated (!NAPI_GRO_CB(skb)-&gt;encap_mark &amp;&amp; !p-&gt;encapsulation)<br /> - Protocol must be either ETH_P_IP or ETH_P_IPV6<br /> - If ETH_P_IPV6, p-&gt;mac_header must be at least<br /> sizeof(struct hop_jumbo_hdr)<br /> <br /> Returning -E2BIG from skb_gro_receive() ensures that packets which cannot<br /> become BIG TCP are cleanly flushed at