CVE-2026-90063: virtio-net: Ensure that TCP packets don't overflow gso_segs

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gso_segs The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size. Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.

Affected products

Linux kernel: from 4.14.187 before 4.15; from 4.19.131 before 4.20; from 5.4.46 before 5.5; from 5.6.18 before 5.7; 5.7 — fixed in 4.15, 4.20, 5.5, 5.7, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 4.15, 4.20, 5.5, 5.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-90063 or the next vulnerability affects your stack