In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO… (CVE-2026-98557)

The Linux kernel gve driver had a vulnerability in the gve_can_send_tso() function, which computes how many buffers each segment of a GSO packet spans. It incorrectly used skb_tcp_all_headers(), which reads the TCP header length, even for UDP GSO packets that lack a TCP header. This caused the header length to be miscalculated, potentially ranging from 0 to 60 bytes instead of the correct transport offset plus UDP header length. Consequently, segment boundaries were shifted, causing either GSO to be unnecessarily disabled or packets to exceed the maximum allowed buffers per segment. The fix corrects this by using the UDP header length for SKB_GSO_UDP_L4 packets, aligning with the behavior of gve_prep_tso().

Miscalculation of header length in UDP GSO packets can lead to two main impacts: (1) unnecessary disabling of GSO, causing the network stack to segment packets inefficiently, potentially degrading performance; (2) the driver may provide the device with packets whose segments span more buffers than supported, which could lead to transmission errors or dropped packets. There is no indication of code execution or data corruption from this issue.

A fix has been applied in the Linux kernel to correctly handle header length calculation for UDP GSO packets in the gve driver. Users should update to the patched kernel version containing this fix. Since this is a kernel-level fix, upgrading the kernel is the recommended remediation. No alternative mitigations are indicated.