CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-01 · updated 2026-10-30
Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: net: use skb_header_pointer() for TCPv4 GSO frag_off check Syzbot reported a KMSAN uninit-value warning in gso_features_check() called from netif_skb_features() [1]. gso_features_check() reads iph->frag_off to decide whether to clear mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr() can rely on skb header offsets that are not always safe for direct dereference on packets injected from PF_PACKET paths. Use skb_header_pointer() for the TCPv4 frag_off check so the header read is robust whether data is already linear or needs copying. [1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407

Affected products

Linux kernel: from 4.7 before 6.12.81; from 6.13 before 6.18.22; from 6.19 before 6.19.12; 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4, 7.0-rc5, 7.0-rc6 — fixed in 6.12.81, 6.18.22, 6.19.12
Linux: 4.7 — fixed in 7.0

How to fix

Upgrade to a fixed version: Linux kernel 6.12.81, 6.18.22, 6.19.12; Linux 7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-43036 or the next vulnerability affects your stack