net: pull headers in qdisc_pkt_len_segs_init()

Summary

CVE	CVE-2026-53091
State	PUBLISHED
Assigner	Linux
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-24 17:17:23 UTC
Updated	2026-07-15 01:16:28 UTC
Description	In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

Primary CVSS: v3.1 7 HIGH from ADP

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001230000 probability, percentile 0.023970000 (date 2026-07-17)

Problem Types: CWE-131 | CWE-131 Incorrect Calculation of Buffer Size

Version	Source	Type	Score	Severity	Vector
3.1	ADP	CVSS	7	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	416baaa9-dc9f-4396-8d5f-8c081fb06d67	Secondary	8.4	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	7	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	DECLARED	8.4	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H`

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Source	Vendor	Product	Version	Platforms
CNA	Linux	Linux	affected e876f208af18b074f800656e4d1b99da75b2135f 9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a git	Not specified
CNA	Linux	Linux	affected e876f208af18b074f800656e4d1b99da75b2135f 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 git	Not specified
CNA	Linux	Linux	affected 3.16	Not specified
CNA	Linux	Linux	unaffected 3.16 semver	Not specified
CNA	Linux	Linux	unaffected 7.0.10 7.0.* semver	Not specified
CNA	Linux	Linux	unaffected 7.1 * original_commit_for_fix	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 6	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified

Reference	Source	Link	Tags
git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org
access.redhat.com/security/cve/CVE-2026-53091	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Source	Time	Event
ADP	2026-06-24T00:00:00.000Z	Reported to Red Hat.
ADP	2026-06-24T00:00:00.000Z	Made public.

There are currently no legacy QID mappings associated with this CVE.