In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gve_prep_tso() notes that… (CVE-2026-98556)

The Linux kernel gve driver vulnerability (CVE-2026-98556) involves improper enforcement of the maximum segment size (MSS) in TSO packets. The gve_prep_tso() function assumed the device's MSS limit (<=9728 bytes) was enforced by the hypervisor's 9K MTU and TSO size limits, but did not validate MSS directly. Packets originating from guests behind taps or packet socket users can specify arbitrary gso_size values in virtio_net_hdr, bypassing MTU checks for GSO packets in the forwarding path. This leads to gve_tx_fill_tso_ctx_desc() placing an incorrect MSS value into a 14-bit field, where a gso_size of 16384 results in MSS zero. The vulnerability is mitigated by dropping such packets in gve_prep_tso() and adjusting gve_features_check_dqo() to preserve GSO bits, allowing software segmentation to handle oversized packets safely. The device can still receive oversized non-TSO packets due to skipped MTU checks in forwarding, which is addressed separately.

This vulnerability could allow malformed or oversized TSO packets with out-of-range MSS values to be processed incorrectly by the gve driver, potentially causing unexpected behavior or packet handling errors. The issue arises from the lack of MSS enforcement and improper handling of GSO packet sizes, which could affect packet segmentation and transmission. However, the vulnerability is mitigated by dropping such packets, preventing malformed packets from being processed by the device.

A fix is available that drops TSO packets with out-of-range MSS values in the gve_prep_tso() function and adjusts feature checks to avoid improper segmentation. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to the patched kernel version is the recommended remediation. No additional action is required beyond applying the official fix.