CVE-2026-53091

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53091
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53091.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-53091
Downstream
AZL (1)
BELL (1)
CGA (102)
DEBIAN (1)
openSUSE (1)
RHSA (6)
RLSA (4)
ROOT (5)
SUSE (11)
UBUNTU (1)
Related
ALSA (4)
openSUSE (1)
SUSE (11)
Published
2026-06-24T16:30:30Z
Modified
2026-10-24T02:34:33Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H CVSS Calculator
Summary
net: pull headers in qdisc_pkt_len_segs_init()
Details

In the Linux kernel, the following vulnerability has been resolved:

net: pull headers in qdisc_pkt_len_segs_init()

Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.

net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len);

qdisc_pkt_len_segs_init() already does a dissection of gso packets.

Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this.

Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53091.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e876f208af18b074f800656e4d1b99da75b2135f
Fixed
5895cfc76924a629c6eaa5e5f049de642860045f
Fixed
7564dc804d8289d2e5c6edb8173754051b71bff4
Fixed
9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a
Fixed
7fb4c19670110f052c04e1ec1d2b953b9f4f57e4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53091.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.16.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
7.0.10

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53091.json"