In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter… (CVE-2026-98853)

The Linux kernel contained a vulnerability in its IP-in-IP GSO implementation where recursive calls to inet_gso_segment() or ipv6_gso_segment() could occur for each nested IP header. The encap_level variable tracked header bytes but not the callback recursion depth, allowing deep nesting to exhaust the kernel stack. This was introduced when inet_gso_segment() became stackable, enabling unbounded IPv4 nesting, and later IPIP GSO/TSO made this path reachable. The IPv6 stackable path shared the same issue. The fix counts IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once per top-level GSO operation and preserved across GRE/UDP context changes. The recursion is limited to five entries, with the sixth call returning -EINVAL to prevent further recursion.

The vulnerability could lead to kernel stack exhaustion due to unbounded recursive IP-in-IP segmentation calls. This may cause denial of service or kernel instability. No known exploits in the wild have been reported. The impact is limited to systems using IP-in-IP GSO features in the Linux kernel.

A fix has been implemented in the Linux kernel to limit recursive IP-in-IP segmentation calls using the IP_TUNNEL_RECURSION_LIMIT. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, upgrading to the patched kernel version is the recommended remediation.