{"id":"CVE-2026-98557","revision":null,"records":[{"revision":"fd8d7cdf927f40a1b6d5baa656fa884f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98557","aliases":[],"title":"gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\n\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\n\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\n\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does.","state":0,"publishedAt":"2026-10-18T15:18:24.415+00:00","modifiedAt":"2026-10-19T09:21:41.472+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/google/gve/gve_tx_dqo.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2f855c52a2e1d3c40d186549ac46cbd88b38eb49\",\n                            \"lessThan\": \"feab3880a72b43913d332c06b75bb80526fa47ba\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"014c607f86abc903d7bf46e13373d89392e371fe\",\n                            \"lessThan\": \"dc9e8964a21f20620dbfca4ef3e11eefa7be6451\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"014c607f86abc903d7bf46e13373d89392e371fe\",\n                            \"lessThan\": \"83769c23fb1879edc916a526ba424285033baf2d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/google/gve/gve_tx_dqo.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/feab3880a72b43913d332c06b75bb80526fa47ba","https://git.kernel.org/stable/c/dc9e8964a21f20620dbfca4ef3e11eefa7be6451","https://git.kernel.org/stable/c/83769c23fb1879edc916a526ba424285033baf2d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98557","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98557","identifiers":["CVE-2026-98557"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T00:02:23.6066046+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T00:02:23.6066046+00:00","lastSuccessAt":"2026-11-09T00:02:23.7657636+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:02:23.7657682+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-06f887e3cff12cdbfc1e6b879a816e143efd9863ce6bea9ec9f7392bb9208c22","complete":true,"records":421267,"lastAttemptAt":"2026-11-09T00:02:15.6996628+00:00","lastSuccessAt":"2026-11-09T00:02:15.5944139+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:02:15.6996628+00:00","snapshotPublishedAt":"2026-11-08T23:22:42+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f237dc1707364963bb107ea6f7331307","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T00:14:09.8878175+00:00","lastSuccessAt":"2026-11-09T00:14:09.883+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:14:09.883+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13624,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T00:02:23.6066046+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T00:02:23.6066046+00:00","lastSuccessAt":"2026-11-09T00:02:23.7665616+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:02:23.7665617+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-47b506589c26469684507bfb31b90a8d","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T00:02:25.3547919+00:00","lastSuccessAt":"2026-11-09T00:02:25.351+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:02:25.351+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T00:02:16.0496746+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:02:16.0496746+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T00:02:15.8362171+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:02:15.8362171+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3b1150af6d7ada2c07356cbab4ead5224c1485027890f71c71d0742cddf0b9e8","complete":true,"records":3055,"lastAttemptAt":"2026-11-09T00:02:23.5770506+00:00","lastSuccessAt":"2026-11-09T00:02:23.4330288+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:02:23.5770506+00:00","snapshotPublishedAt":"2026-11-08T23:17:54+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-09T00:02:15.9369765+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-09T00:02:15.9369765+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}