Status: UPDATED | Advisory ID: CVE-2026-53091
| CVE | CVE-2026-53091 |
| CVSS Score / Version | |
| Updated | 2026-10-16 |
| CVSS Vector | |
| CVSS Prose | |
| Affected products | |
| Classified as |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Linux | Linux Kernel | ||
| Red Hat | Red Hat Enterprise Linux 10 | ||
| Red Hat | Red Hat Enterprise Linux 8 | ||
| Red Hat | Red Hat Enterprise Linux 9 | ||
| Red Hat | Red Hat Enterprise Linux 7 |
| Subsystems | OT Supporting Infrastructure |
| Sectors | All Sectors |
In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdisc_pkt_len_segs_init()
Most ndo_start_xmit() methods expects headers of gso packets
to be already in skb->head.
net/core/tso.c users are particularly at risk, because tso_build_hdr()
does a memcpy(hdr, skb->data, hdr_len);
qdisc_pkt_len_segs_init() already does a dissection of gso packets.
Use pskb_may_pull() instead of skb_header_pointer() to make
sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can
drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason. (NVD)
Monitor Linux's and Red Hat's web pages for any future patch releases.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-53091 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-53091 |