Linux Kernel Vulnerability in GSO with Nested IP Headers by Linux

CVE-2026-98853

What is CVE-2026-98853?

A vulnerability exists in the Linux kernel related to Generic Segmentation Offload (GSO) processing for nested IP headers. This issue arises when IP-in-IP GSO processing allows for excessive recursion within the functions inet_gso_segment() and ipv6_gso_segment(). Since encap_level only tracks the number of header bytes and not the depth of callback calls, a deeply nested structure can lead to a kernel stack exhaustion. To mitigate this, the kernel has been improved to limit the number of entries to five before returning an error for any further attempts at nesting. This safeguard helps in preventing potential crashes or vulnerabilities that could be exploited by malicious actors.

References