CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.

However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
dereference because local TCP packets do not use frag_list.

Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from
ip6_default_advmss() when MTU is large.

Also update the stale comment in ip6_default_advmss() which suggested
that IPV6_MAXPLEN is returned to mean "any MSS".

The Linux kernel CVE team has assigned CVE-2026-72502 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 5.10.261 with commit 560b33b434e922ef97f9ff23aa2e909ef7aacd5c
	Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 5.15.212 with commit 21f69ac1879bb970588d5e7c12a96e6542f7c1a7
	Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 6.1.178 with commit c0db3dc2ac323b6c4b76adede3b355a9daa6dea8
	Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 6.6.145 with commit 572fff10819dfc359298d1f774839e76a4d96f93
	Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 6.12.97 with commit 8e6214a530c03e341dc1b0a846c8f2b716b3551a
	Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 6.18.40 with commit d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e
	Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 7.1.5 with commit a210791f33345aa87187f7d7a9f3b9b7f4a28e6d
	Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 7.2-rc1 with commit 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72502
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/route.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/560b33b434e922ef97f9ff23aa2e909ef7aacd5c
	https://git.kernel.org/stable/c/21f69ac1879bb970588d5e7c12a96e6542f7c1a7
	https://git.kernel.org/stable/c/c0db3dc2ac323b6c4b76adede3b355a9daa6dea8
	https://git.kernel.org/stable/c/572fff10819dfc359298d1f774839e76a4d96f93
	https://git.kernel.org/stable/c/8e6214a530c03e341dc1b0a846c8f2b716b3551a
	https://git.kernel.org/stable/c/d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e
	https://git.kernel.org/stable/c/a210791f33345aa87187f7d7a9f3b9b7f4a28e6d
	https://git.kernel.org/stable/c/2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22