In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in __virtio_net_hdr_to_skb() Commit 9e8db5913264… (CVE-2026-98954)

The Linux kernel vulnerability CVE-2026-98954 concerns the __virtio_net_hdr_to_skb() function's handling of GSO packets. A previous patch added a check for skb->network_header before dissecting GSO packets, but since skb->network_header can validly be zero, some callers bypassed flow dissection. This caused fallback code to inadequately validate packet headers, allowing malformed packets to pass unchecked. This led to out-of-bounds reads in skb_gso_transport_seglen() when TCP headers were outside skb->head, triggering kernel slab-out-of-bounds bugs detected by KASAN. The fix initializes skb->dev and skb->network_header before calling virtio_net_hdr_*_to_skb() in affected callers, removes the faulty skb->network_header check, and moves protocol validation to after flow dissection to ensure proper packet validation and header setup.

The vulnerability can cause out-of-bounds memory reads in the kernel's network stack when processing certain malformed or specially crafted GSO packets. This may lead to kernel crashes or memory corruption detectable by KASAN. No known exploits in the wild have been reported. The impact is primarily a kernel stability and memory safety issue.

A fix has been implemented in the Linux kernel source to properly initialize skb fields and ensure all GSO packets are dissected and validated. Users should apply the official kernel patch containing commit 9e8db5913264 or upgrade to a kernel version that includes this fix. No additional mitigations are indicated by the vendor advisory.