CVE-2026-98557

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98557", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.357Z", "datePublished": "2026-10-18T15:18:24.415Z", "dateUpdated": "2026-10-19T09:21:41.472Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:41.472Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\n\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\n\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\n\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/google/gve/gve_tx_dqo.c"], "versions": [{"version": "2f855c52a2e1d3c40d186549ac46cbd88b38eb49", "lessThan": "feab3880a72b43913d332c06b75bb80526fa47ba", "status": "affected", "versionType": "git"}, {"version": "014c607f86abc903d7bf46e13373d89392e371fe", "lessThan": "dc9e8964a21f20620dbfca4ef3e11eefa7be6451", "status": "affected", "versionType": "git"}, {"version": "014c607f86abc903d7bf46e13373d89392e371fe", "lessThan": "83769c23fb1879edc916a526ba424285033baf2d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/google/gve/gve_tx_dqo.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/feab3880a72b43913d332c06b75bb80526fa47ba"}, {"url": "https://git.kernel.org/stable/c/dc9e8964a21f20620dbfca4ef3e11eefa7be6451"}, {"url": "https://git.kernel.org/stable/c/83769c23fb1879edc916a526ba424285033baf2d"}], "title": "gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/google/gve/gve_tx_dqo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "feab3880a72b43913d332c06b75bb80526fa47ba", "status": "affected", "version": "2f855c52a2e1d3c40d186549ac46cbd88b38eb49", "versionType": "git"}, {"lessThan": "dc9e8964a21f20620dbfca4ef3e11eefa7be6451", "status": "affected", "version": "014c607f86abc903d7bf46e13373d89392e371fe", "versionType": "git"}, {"lessThan": "83769c23fb1879edc916a526ba424285033baf2d", "status": "affected", "version": "014c607f86abc903d7bf46e13373d89392e371fe", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/google/gve/gve_tx_dqo.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\n\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\n\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\n\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does."}], "id": "CVE-2026-98557", "lastModified": "2026-10-19T10:19:12.217", "metrics": {}, "published": "2026-10-18T16:17:07.830", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83769c23fb1879edc916a526ba424285033baf2d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc9e8964a21f20620dbfca4ef3e11eefa7be6451"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/feab3880a72b43913d332c06b75bb80526fa47ba"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO", "id": "2555017", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555017"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does.", "A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by transmitting network traffic that uses User Datagram Protocol (UDP) Generic Segmentation Offload (GSO). Because the driver improperly attempts to read Transmission Control Protocol (TCP) headers on UDP packets, it miscalculates packet header lengths and can submit oversized packet segments to the network device, leading to transmission failures or device stalls."], "name": "CVE-2026-98557", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98557\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98557\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98557.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f855c52a2e1d3c40d186549ac46cbd88b38eb49,feab3880a72b43913d332c06b75bb80526fa47ba)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[014c607f86abc903d7bf46e13373d89392e371fe,dc9e8964a21f20620dbfca4ef3e11eefa7be6451)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[014c607f86abc903d7bf46e13373d89392e371fe,83769c23fb1879edc916a526ba424285033baf2d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:15:15.189916+00:00", "updated": "2026-10-20T20:45:14.315003+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}