Look up another CVE · open CVE-2026-80725 in the interactive tracker
CVE-2026-80725
net: gro: properly validate BIG TCP aggregation criteria
Published 2026-08-29 (2 months ago) by the Linux kernel CNA. Subsystem net/core. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80725 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6477-1 · 2026-08-29 · text | 6.12.107-1 | Update the kernel and reboot. DSA-6477-1 shipped the fix on 2026-08-29, in 6.12.107-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.3-1 | Update the kernel and reboot. Fixed in 7.0.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.3-1 | Update the kernel and reboot. Fixed in 7.0.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB), BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP (with sufficient MAC header room to insert the temporary HBH jumbo header). However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp") loosened the check in skb_gro_receive(), leading to several issues: 1. skb_gro_receive() checked skb_headroom(p) instead of the actual space before the MAC header (p->mac_header). Because skb_headroom(p) includes mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the temporary HBH jumbo header, the memmove() starts before skb->head, causing an out-of-bounds write and wrapping skb->mac_header. 2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q / ETH_P_8021AD) to aggregate beyond 64KB because p->protocol != ETH_P_IPV6 was true. 3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark, allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate beyond 64KB. Fix skb_gro_receive() to strictly enforce: - NAPI_GRO_CB(skb)->proto == IPPROTO_TCP - Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation) - Protocol must be either ETH_P_IP or ETH_P_IPV6 - If ETH_P_IPV6, p->mac_header must be at least sizeof(struct hop_jumbo_hdr) Returning -E2BIG from skb_gro_receive() ensures that packets which cannot become BIG TCP are cleanly flushed at <= 64KB and delivered intact without dropping. This issue does not exist in mainline (7.0+) because the subsystem was rewritten in commit 81be30c1f5f2 ("net/ipv6: Drop HBH for BIG TCP on RX side"), making this fix relevant only for older stable branches like 6.18.y.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/core/gro.c
- What this is
- NETWORKING [GENERAL]MAINTAINERS section matched on net/ · netdev@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-08-29 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.46%, higher than 38.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/core
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.19 | 6.1.185 | 37a5dcd6837f |
| 5.19 | 6.6.154 | e907bf694ed5 |
| 5.19 | 6.12.106 | 03cb8cc2961f |
| 5.19 | 6.18.47 | 3ce832e2bd43 |
| 5.19 | 7.0 | 81be30c1f5f2 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6477-1 | 2026-08-29 | trixie 6.12.107-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The flaw is in skb_gro_receive() on the netdev NAPI GRO ingress path (netif_receive_skb→napi_gro_receive→dev_gro_receive→tcp/ipv6 gro handlers); remote peers can deliver crafted in-flow TCP streams to internet-facing interfaces without local access.
- AC:LAttack complexity, low
- On Big TCP deployments with gro_max_size>64KB, an attacker reliably coalesces past GRO_LEGACY_MAX_SIZE by sending many same-flow TCP segments; AF_PACKET injection also gives deterministic header layout control without races or victim-dependent heap layout.
- PR:NPrivileges required, none
- RX GRO runs in softirq on all received packets before socket authentication; no target credentials or capabilities are required. Elevated gro_max_size is an admin tuning prerequisite of the Big TCP server class, not an attacker privilege.
- UI:NUser interaction, none
- Packet reception and GRO aggregation are automatic kernel network-stack processing triggered solely by attacker-sent traffic; no victim mount, file open, or other interaction is required.
- S:UScope, unchanged
- Impact is kernel skb/heap memory corruption within the host kernel security authority; exploitation does not cross VM, container, or IOMMU boundaries that would warrant scope-changed scoring.
- C:HConfidentiality impact, high
- When undersized mac_header room passes the broken skb_headroom check, ipv6_gro_complete() memmove() for the temporary HBH jumbo header writes before skb->head, corrupting adjacent kernel memory and enabling information disclosure from attacker-influenced out-of-bounds writes.
- I:HIntegrity impact, high
- The same invalid BIG TCP aggregation drives attacker-controlled memmove/header corruption that wraps skb->mac_header, yielding an out-of-bounds write primitive suitable for heap object corruption, control-flow hijacking, and local privilege escalation.
- A:HAvailability impact, high
- The defective memmove or invalid >64KB aggregation on disallowed VLAN, encapsulated, or malformed flows can oops or panic the kernel during GRO completion, and a remote attacker can trigger this repeatedly to deny service.