Linux CVE-2026-23254

The vulnerability resides in the Linux kernel's networking subsystem, specifically in the GRO (Generic Receive Offload) completion logic for UDP traffic. GRO is a kernel feature that coalesces multiple incoming packets into larger payloads before processing, improving throughput by reducing per-packet overhead. The affected code path is triggered when packets with the encapsulation flag set are processed through udp4_gro_complete(), which is responsible for finalizing GRO packet aggregation and computing checksums for the outer UDP header. The root cause is an assumption that all GRO-processed packets have the encapsulation flag cleared; however, modern hardware offloading capabilities, virtualization drivers (tun), and virtual networking setups (veth) can preserve or set this flag. When the flag is set, the code incorrectly uses the inner packet's network offset instead of the outer packet's offset to locate the UDP header for pseudo checksum computation. This is a logic error in packet header interpretation rather than a memory safety issue, making it a class of incorrect data processing vulnerability. The affected product is the Linux kernel across all architectures (as indicated by the wildcard CPE), with the vulnerability present in the core networking stack module.