{"api_version":"1","generated_at":"2026-08-29T11:58:03+00:00","cve":"CVE-2026-80725","urls":{"html":"https://cve.report/CVE-2026-80725","api":"https://cve.report/api/cve/CVE-2026-80725.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-80725","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80725"},"summary":{"title":"net: gro: properly validate BIG TCP aggregation criteria","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 (\"net: add support for ipv4 big tcp\")\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n   before the MAC header (p->mac_header). Because skb_headroom(p) includes\n   mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n   with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the\n   temporary HBH jumbo header, the memmove() starts before skb->head,\n   causing an out-of-bounds write and wrapping skb->mac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n   ETH_P_8021AD) to aggregate beyond 64KB because\n   p->protocol != ETH_P_IPV6 was true.\n3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark,\n   allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n   beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)->proto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p->mac_header must be at least\n  sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at <= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 (\"net/ipv6: Drop HBH for BIG TCP on RX\nside\"), making this fix relevant only for older stable branches like\n6.18.y.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-29 07:16:54","updated_at":"2026-08-29 07:16:54"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/03cb8cc2961f5f781d12e903782cb3815ed84b1c","name":"https://git.kernel.org/stable/c/03cb8cc2961f5f781d12e903782cb3815ed84b1c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e907bf694ed55bdfe421be99dba35751a655df25","name":"https://git.kernel.org/stable/c/e907bf694ed55bdfe421be99dba35751a655df25","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/81be30c1f5f2bffda1f04c0efd0746af10b9643a","name":"https://git.kernel.org/stable/c/81be30c1f5f2bffda1f04c0efd0746af10b9643a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/37a5dcd6837fc2afc44a7bc3ed8af4e983783d46","name":"https://git.kernel.org/stable/c/37a5dcd6837fc2afc44a7bc3ed8af4e983783d46","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3ce832e2bd431d0c12ba525ed73ad8fbc4191da5","name":"https://git.kernel.org/stable/c/3ce832e2bd431d0c12ba525ed73ad8fbc4191da5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80725","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80725","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 37a5dcd6837fc2afc44a7bc3ed8af4e983783d46 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 e907bf694ed55bdfe421be99dba35751a655df25 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 03cb8cc2961f5f781d12e903782cb3815ed84b1c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 3ce832e2bd431d0c12ba525ed73ad8fbc4191da5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 81be30c1f5f2bffda1f04c0efd0746af10b9643a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.185 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.154 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.106 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.47 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/gro.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"37a5dcd6837fc2afc44a7bc3ed8af4e983783d46","status":"affected","version":"0fe79f28bfaf73b66b7b1562d2468f94aa03bd12","versionType":"git"},{"lessThan":"e907bf694ed55bdfe421be99dba35751a655df25","status":"affected","version":"0fe79f28bfaf73b66b7b1562d2468f94aa03bd12","versionType":"git"},{"lessThan":"03cb8cc2961f5f781d12e903782cb3815ed84b1c","status":"affected","version":"0fe79f28bfaf73b66b7b1562d2468f94aa03bd12","versionType":"git"},{"lessThan":"3ce832e2bd431d0c12ba525ed73ad8fbc4191da5","status":"affected","version":"0fe79f28bfaf73b66b7b1562d2468f94aa03bd12","versionType":"git"},{"lessThan":"81be30c1f5f2bffda1f04c0efd0746af10b9643a","status":"affected","version":"0fe79f28bfaf73b66b7b1562d2468f94aa03bd12","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/gro.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.185","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.154","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.106","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.47","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.185","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.154","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.106","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.47","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0","versionStartIncluding":"5.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 (\"net: add support for ipv4 big tcp\")\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n   before the MAC header (p->mac_header). Because skb_headroom(p) includes\n   mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n   with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the\n   temporary HBH jumbo header, the memmove() starts before skb->head,\n   causing an out-of-bounds write and wrapping skb->mac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n   ETH_P_8021AD) to aggregate beyond 64KB because\n   p->protocol != ETH_P_IPV6 was true.\n3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark,\n   allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n   beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)->proto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p->mac_header must be at least\n  sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at <= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 (\"net/ipv6: Drop HBH for BIG TCP on RX\nside\"), making this fix relevant only for older stable branches like\n6.18.y."}],"providerMetadata":{"dateUpdated":"2026-08-29T06:40:30.300Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/37a5dcd6837fc2afc44a7bc3ed8af4e983783d46"},{"url":"https://git.kernel.org/stable/c/e907bf694ed55bdfe421be99dba35751a655df25"},{"url":"https://git.kernel.org/stable/c/03cb8cc2961f5f781d12e903782cb3815ed84b1c"},{"url":"https://git.kernel.org/stable/c/3ce832e2bd431d0c12ba525ed73ad8fbc4191da5"},{"url":"https://git.kernel.org/stable/c/81be30c1f5f2bffda1f04c0efd0746af10b9643a"}],"title":"net: gro: properly validate BIG TCP aggregation criteria","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-80725","datePublished":"2026-08-29T06:39:35.212Z","dateReserved":"2026-08-26T14:34:25.789Z","dateUpdated":"2026-08-29T06:40:30.300Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-29 07:16:54","lastModifiedDate":"2026-08-29 07:16:54","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"80725","Ordinal":"1","Title":"net: gro: properly validate BIG TCP aggregation criteria","CVE":"CVE-2026-80725","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"80725","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 (\"net: add support for ipv4 big tcp\")\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n   before the MAC header (p->mac_header). Because skb_headroom(p) includes\n   mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n   with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the\n   temporary HBH jumbo header, the memmove() starts before skb->head,\n   causing an out-of-bounds write and wrapping skb->mac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n   ETH_P_8021AD) to aggregate beyond 64KB because\n   p->protocol != ETH_P_IPV6 was true.\n3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark,\n   allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n   beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)->proto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p->mac_header must be at least\n  sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at <= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 (\"net/ipv6: Drop HBH for BIG TCP on RX\nside\"), making this fix relevant only for older stable branches like\n6.18.y.","Type":"Description","Title":"net: gro: properly validate BIG TCP aggregation criteria"}]}}}