{"id":"CVE-2026-90063","revision":"5d9ad024068e46fcb039e31ebb32fb4d","records":[{"revision":"5d9ad024068e46fcb039e31ebb32fb4d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90063","aliases":[],"title":"virtio-net: Ensure that TCP packets don't overflow gso_segs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: Ensure that TCP packets don't overflow gso_segs\n\nThe user can specify any gso_size in a packet crafted with an AF_PACKET\nPACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the\nsame time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user\ncrafts a packet with gso_size < 8, there is a risk for partial GSO to\noverflow the 16-bit gso_segs field when dividing the SKB length by\ngso_size.\n\nAdjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep\ngso_size of UDP GSO packets, as gso_size=1 is valid and explicitly\ntested at tools/testing/selftests/net/tun.c:649.","state":0,"publishedAt":"2026-09-17T16:05:46.968+00:00","modifiedAt":"2026-10-19T08:57:20.621+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/virtio_net.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7c6d2ecbda83150b2036a2b36b21381ad4667762\",\n                            \"lessThan\": \"d3d111fe809773edbb4ae121e36253b7d683509a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c6d2ecbda83150b2036a2b36b21381ad4667762\",\n                            \"lessThan\": \"8f6667a081887c2b59c6f3dd86c1789ada563762\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c6d2ecbda83150b2036a2b36b21381ad4667762\",\n                            \"lessThan\": \"339f47ae04dcc6b5a730dd6bc70dddc8937c3260\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c6d2ecbda83150b2036a2b36b21381ad4667762\",\n                            \"lessThan\": \"29bd12c7c5f9d6cf855b87bace18f71e9607f9e8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c6d2ecbda83150b2036a2b36b21381ad4667762\",\n                            \"lessThan\": \"0e5ed3b98d1d8d251acfdccfeaa607453ad12954\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c6d2ecbda83150b2036a2b36b21381ad4667762\",\n                            \"lessThan\": \"75c271c48f483af678e514734e10b2452410e08c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7c6d2ecbda83150b2036a2b36b21381ad4667762\",\n                            \"lessThan\": \"c27c449d455aafd9018a3cbab150f1c42c87923f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfbaf151efe491e30697e21c8b7ae1b615480873\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6c83456601e65a6dd371ddf595510183d198e9b1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b3ebd9830c6026c98f03f7047c9d608573773f13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b96fb681ca789629b8ba3da99ca3b2e6fa807f0a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4.14.187\",\n                            \"lessThan\": \"4.15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.131\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.46\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.6.18\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/virtio_net.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/d3d111fe809773edbb4ae121e36253b7d683509a","https://git.kernel.org/stable/c/8f6667a081887c2b59c6f3dd86c1789ada563762","https://git.kernel.org/stable/c/339f47ae04dcc6b5a730dd6bc70dddc8937c3260","https://git.kernel.org/stable/c/29bd12c7c5f9d6cf855b87bace18f71e9607f9e8","https://git.kernel.org/stable/c/0e5ed3b98d1d8d251acfdccfeaa607453ad12954","https://git.kernel.org/stable/c/75c271c48f483af678e514734e10b2452410e08c","https://git.kernel.org/stable/c/c27c449d455aafd9018a3cbab150f1c42c87923f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90063","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90063","identifiers":["CVE-2026-90063"]},"retained":false,"historicalAffected":[]}],"coverage":[]}