VulnerabilityPublished 4 Sep 2026Updated 6 Nov 2026

CVE-2026-80793: Linux kernel · ipv4: reject undersized MTUs in ip_do_fragment()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in d9d1a676b033acabf8e5645f730486d1f8204a3f : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:40 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in d9d1a676b033acabf8e5645f730486d1f8204a3f, c0726f0caf8c6b3208552949e17d23634a2f3129, c8a74adccaf028223054633b532593101dfcc581 +6

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < d9d1a676b033acabf8e5645f730486d1f8204a3f	Fixed in d9d1a676b033acabf8e5645f730486d1f8204a3f
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c0726f0caf8c6b3208552949e17d23634a2f3129	Fixed in c0726f0caf8c6b3208552949e17d23634a2f3129
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < c8a74adccaf028223054633b532593101dfcc581	Fixed in c8a74adccaf028223054633b532593101dfcc581
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b0ea911453ce7210e8200a07a94d2458bd1e6430	Fixed in b0ea911453ce7210e8200a07a94d2458bd1e6430
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a716a64a4ba68cd46f2745fba2b1099fe8e0aa59	Fixed in a716a64a4ba68cd46f2745fba2b1099fe8e0aa59
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3556beb8ca86677af2aca5bfbed6f8e790fccc83	Fixed in 3556beb8ca86677af2aca5bfbed6f8e790fccc83

AI-suggested

A fix is available and has been applied in the Linux kernel source code. Systems should update to a kernel version that includes the fix identified by the listed commit hashes. No additional mitigation is required once the patch is applied.

Description

A vulnerability in the Linux kernel's IPv4 fragmentation code allows undersized MTUs to cause a fragmentation state deadlock, leading to a softlockup. The function ip_do_fragment() fails to reject MTUs smaller than the IPv4 header length plus 8 bytes, causing ip_frag_next() to produce zero-length fragments and the fragmentation process to stall indefinitely. This issue can be triggered by routes or devices with very small MTUs (e.g., MTU=20). The flaw has been fixed by adding a check to reject MTUs smaller than the required minimum.

Impact

The vulnerability causes a denial of service condition in the Linux kernel by stalling the IPv4 fragmentation process. This leads to a softlockup where the kernel continuously allocates and sends header-only fragments without making forward progress, potentially impacting network functionality and system stability on affected Linux systems.

Summary

CVE-2026-80793 is a Linux kernel vulnerability in the IPv4 fragmentation logic where ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the payload MTU to ip_frag_next(). If the effective MTU is less than the header length plus 8 bytes, ip_frag_next() rounds the fragment payload length down to zero, causing the fragmentation state to never progress. This results in continuous allocation and transmission of header-only fragments until the kernel's softlockup detector triggers. The issue is reproducible with routes or devices configured with very small MTUs (e.g., MTU locked to 20). The fix involves rejecting MTUs smaller than the IPv4 header length plus 8 bytes with an -EMSGSIZE error, aligning with existing IPv6 fragmentation checks.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:40 UTC

Technical details

References

Community reviews

Related threats