CVE-2026-23254
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
net: gro: fix outer network offset
The udp GRO complete stage assumes that all the packets inserted the RX have the `encapsulation` flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup.
Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner instead of outer) to compute the outer UDP header pseudo checksum, leading to csum validation errors later on in packet processing.
Leer descripción completaMostrar menos
Address the issue always clearing the encapsulation flag at GRO completion time. Such flag will be set again as needed for encapsulated packets by udp_gro_complete().
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.11%
- Percentil entre todas las CVEs puntuadas: 1
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-23254",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "af276a5ac8e938c8b058e3e124073cc1e322d98b",
"lessThan": "9d40a85138568696387ef04cd004c64612a70874",
"versionType": "git"
},
{
"status": "affected",
"version": "5ef31ea5d053a8f493a772ebad3f3ce82c35d845",
"lessThan": "b83557bc6f560433fe5d727e241069f8db5ba709",
"versionType": "git"
},
{
"status": "affected",
"version": "5ef31ea5d053a8f493a772ebad3f3ce82c35d845",
"lessThan": "2e5edb69e5d0e23ef248c56fc977039268c77a7b",
"versionType": "git"
},
{
"status": "affected",
"version": "5ef31ea5d053a8f493a772ebad3f3ce82c35d845",
"lessThan": "5c2c3c38be396257a6a2e55bd601a12bb9781507",
"versionType": "git"
},
{
"status": "affected",
"version": "dbd9466d323a72e22efe09151253d195d36d3bf6",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.31",
"lessThan": "6.6.124",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.8.10",
"lessThan": "6.9",
"versionType": "semver"
}
],
"programFiles": [
"net/core/gro.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.124",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.70",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.10",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/gro.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-03-18T18:16:23.530",
"references": [
{
"url": "https://git.kernel.org/stable/c/2e5edb69e5d0e23ef248c56fc977039268c77a7b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5c2c3c38be396257a6a2e55bd601a12bb9781507",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9d40a85138568696387ef04cd004c64612a70874",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b83557bc6f560433fe5d727e241069f8db5ba709",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix outer network offset\n\nThe udp GRO complete stage assumes that all the packets inserted the RX\nhave the `encapsulation` flag zeroed. Such assumption is not true, as a\nfew H/W NICs can set such flag when H/W offloading the checksum for\nan UDP encapsulated traffic, the tun driver can inject GSO packets with\nUDP encapsulation and the problematic layout can also be created via\na veth based setup.\n\nDue to the above, in the problematic scenarios, udp4_gro_complete() uses\nthe wrong network offset (inner instead of outer) to compute the outer\nUDP header pseudo checksum, leading to csum validation errors later on\nin packet processing.\n\nAddress the issue always clearing the encapsulation flag at GRO completion\ntime. Such flag will be set again as needed for encapsulated packets by\nudp_gro_complete()."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: gro: corregir desplazamiento de red externo\n\nLa etapa de completado de GRO de UDP asume que todos los paquetes insertados en el RX tienen el indicador 'encapsulation' puesto a cero. Dicha suposición no es cierta, ya que algunas NIC de H/W pueden establecer dicho indicador al descargar el checksum por H/W para un tráfico UDP encapsulado, el controlador tun puede inyectar paquetes GSO con encapsulación UDP y la disposición problemática también puede crearse a través de una configuración basada en veth.\n\nDebido a lo anterior, en los escenarios problemáticos, udp4_gro_complete() utiliza el desplazamiento de red incorrecto (interno en lugar de externo) para calcular el pseudo checksum del encabezado UDP externo, lo que lleva a errores de validación de csum más adelante en el procesamiento de paquetes.\n\nAbordar el problema siempre borrando el indicador de encapsulación en el momento de completado de GRO. Dicho indicador se establecerá de nuevo según sea necesario para paquetes encapsulados por udp_gro_complete()."
}
],
"lastModified": "2026-06-17T10:21:11.670",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7227C1EF-FAE4-4A81-A334-1487EFCBF507",
"versionEndExcluding": "6.6.124",
"versionStartIncluding": "6.6.31"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD26A649-FB0B-4A7B-A16B-A9D27807D7E9",
"versionEndExcluding": "6.9",
"versionStartIncluding": "6.8.10"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "389604B3-C4AF-4558-AE99-65329C545794",
"versionEndExcluding": "6.12.70",
"versionStartIncluding": "6.9.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7156C23F-009E-4D05-838C-A2DA417B5B8D",
"versionEndExcluding": "6.18.10",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DAECDCD8-F556-4606-8D7B-5C6D47A501F2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}