Skip to main content

Linux Kernel CVE-2026-46273

| EUVDEUVD-2026-34138 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-03 Linux GHSA-c3jf-v88j-7gvj
Denial Of Service Linux
8.6
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 05, 2026 - 07:31 vuln.today
CVSS changed
Jun 05, 2026 - 07:22 NVD
8.6 (HIGH)
Patch available
Jun 03, 2026 - 19:01 EUVD
CVE Published
Jun 03, 2026 - 16:19 nvd
UNKNOWN (no severity yet)
CVE Published
Jun 03, 2026 - 16:19 nvd
HIGH 8.6

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ibmveth: Disable GSO for packets with small MSS

Some physical adapters on Power systems do not support segmentation offload when the MSS is less than 224 bytes. Attempting to send such packets causes the adapter to freeze, stopping all traffic until manually reset.

Implement ndo_features_check to disable GSO for packets with small MSS values. The network stack will perform software segmentation instead.

The 224-byte minimum matches ibmvnic commit <f10b09ef687f> ("ibmvnic: Enforce stronger sanity checks on GSO packets") which uses the same physical adapters in SEA configurations.

The issue occurs specifically when the hardware attempts to perform segmentation (gso_segs > 1) with a small MSS. Single-segment GSO packets (gso_segs == 1) do not trigger the problematic LSO code path and are transmitted normally without segmentation.

Add an ndo_features_check callback to disable GSO when MSS < 224 bytes. Also call vlan_features_check() to ensure proper handling of VLAN packets, particularly QinQ (802.1ad) configurations where the hardware parser may not support certain offload features.

Validated using iptables to force small MSS values. Without the fix, the adapter freezes. With the fix, packets are segmented in software and transmission succeeds. Comprehensive regression testing completedd (MSS tests, performance, stability).

AnalysisAI

Remote denial of service in the Linux kernel ibmveth driver on IBM Power systems allows attackers to freeze physical network adapters by transmitting GSO packets with an MSS below 224 bytes, halting all traffic until manual reset. The flaw affects multiple stable kernel branches and is fixed upstream, with no public exploit identified at time of analysis and an EPSS score of 0.02% (7th percentile) reflecting low expected exploitation volume despite the high CVSS of 8.6.

Technical ContextAI

The ibmveth driver provides virtual Ethernet support for IBM Power LPARs and bridges traffic to physical adapters, some of which cannot perform Large Send Offload (LSO/GSO) segmentation when the MSS is less than 224 bytes. When the network stack hands such packets to the adapter with gso_segs > 1, the hardware enters a wedged state and stops forwarding all traffic. The fix introduces an ndo_features_check callback that disables GSO for sub-224-byte MSS values (forcing software segmentation) and invokes vlan_features_check() to correctly handle 802.1ad QinQ stacked-VLAN configurations the hardware parser cannot offload. CWE is not assigned by NVD, but the root cause is improper input validation of offload parameters before they are passed to hardware (CWE-20 class).

RemediationAI

Vendor-released patch: update to the nearest stable kernel containing the ibmveth ndo_features_check fix - 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7, or 7.1-rc2 - using the upstream commits at https://git.kernel.org/stable/c/86fc64584811d43c9ccd74447de58620189d8b77 and the parallel stable backports (1cdf5dbc, 82bc89fb, db8012c6, c1f26186, 3af24f0c, cc427d24, 9a5e984d). Until a kernel reboot into a patched build is possible, compensating controls on IBM Power LPARs include disabling TSO/GSO on the ibmveth interface (ethtool -K ethX tso off gso off), which eliminates the wedge condition at the cost of CPU overhead from software segmentation, and clamping MSS upstream (iptables/nftables TCPMSS --set-mss 224 or higher on forwarding paths) to prevent small-MSS packets from reaching the adapter - note this can break path MTU discovery for legitimate small-MTU endpoints. Distribution-vendor advisories (RHEL/SUSE/Ubuntu for ppc64le builds) should be consulted for backported errata kernels.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-46273 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy