From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-72502: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
Date: Sat, 15 Aug 2026 15:09:41 +0900 [thread overview]
Message-ID: <2026081541-CVE-2026-72502-cd8e@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.
However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
dereference because local TCP packets do not use frag_list.
Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from
ip6_default_advmss() when MTU is large.
Also update the stale comment in ip6_default_advmss() which suggested
that IPV6_MAXPLEN is returned to mean "any MSS".
The Linux kernel CVE team has assigned CVE-2026-72502 to this issue.
Affected and fixed versions
===========================
Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 5.10.261 with commit 560b33b434e922ef97f9ff23aa2e909ef7aacd5c
Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 5.15.212 with commit 21f69ac1879bb970588d5e7c12a96e6542f7c1a7
Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 6.1.178 with commit c0db3dc2ac323b6c4b76adede3b355a9daa6dea8
Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 6.6.145 with commit 572fff10819dfc359298d1f774839e76a4d96f93
Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 6.12.97 with commit 8e6214a530c03e341dc1b0a846c8f2b716b3551a
Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 6.18.40 with commit d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e
Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 7.1.5 with commit a210791f33345aa87187f7d7a9f3b9b7f4a28e6d
Issue introduced in 4.8 with commit 3953c46c3ac7eef31a9935427371c6f54a22f1ba and fixed in 7.2-rc1 with commit 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-72502
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
net/ipv6/route.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/560b33b434e922ef97f9ff23aa2e909ef7aacd5c
https://git.kernel.org/stable/c/21f69ac1879bb970588d5e7c12a96e6542f7c1a7
https://git.kernel.org/stable/c/c0db3dc2ac323b6c4b76adede3b355a9daa6dea8
https://git.kernel.org/stable/c/572fff10819dfc359298d1f774839e76a4d96f93
https://git.kernel.org/stable/c/8e6214a530c03e341dc1b0a846c8f2b716b3551a
https://git.kernel.org/stable/c/d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e
https://git.kernel.org/stable/c/a210791f33345aa87187f7d7a9f3b9b7f4a28e6d
https://git.kernel.org/stable/c/2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22
reply other threads:[~2026-08-15 6:33 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026081541-CVE-2026-72502-cd8e@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox