Skip to main content

Linux Kernel CVE-2026-53091

| EUVDEUVD-2026-38959 HIGH
Incorrect Calculation of Buffer Size (CWE-131)
2026-06-24 Linux GHSA-mjfm-6cr9-5cqx
Information Disclosure Linux
8.4
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local socket with CAP_NET_RAW
  2. Delivery
    Craft GSO packet with headers in fragments
  3. Exploit
    Transmit through qdisc segmentation path
  4. Execution
    Trigger out-of-bounds memcpy in tso_build_hdr
  5. Impact
    Leak kernel memory or crash host

Vulnerability Assessment

Weakness
CWE
CWE-131
ASVS 5.0
V15 - Secure Coding and Architecture Buffer size calculation
Exploitation Conditions

Exploitation requires local access (AV:L) and the ability to inject malformed GSO/segmentation-offload packets whose headers are NOT linearized into skb->head - in practice this means privileged socket access such as CAP_NET_RAW (AF_PACKET), a tun/tap device, or a virtio/offload-capable transmit path, matching the PR:L requirement. The exact triggering condition is a GSO packet that reaches qdisc_pkt_len_segs_init() with headers in non-linear (paged) data, causing the downstream tso_build_hdr() memcpy to over-read. Limiting factors: it is not remotely exploitable against default configurations by an unauthenticated network attacker, the attacker must already be local and possess packet-injection privileges, and hosts that confine untrusted tenants without CAP_NET_RAW or raw-socket access are not practically exposed; there is no required user interaction (UI:N).
Impact

Signals are mixed and lean toward a real but not urgent fix-on-cadence item. The CVSS 3.1 base of 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H) is high largely because of the scope-change and dual confidentiality+availability impact, yet the attack vector is explicitly Local (AV:L) and requires some privilege (PR:L), which bounds blast radius to actors who already have a foothold and the ability to inject crafted GSO packets (typically via a privileged socket interface such as AF_PACKET/CAP_NET_RAW, tun/tap, or virtio paths). EPSS is very low at 0.15% (5th percentile), the CVE is NOT in CISA KEV, and no POC is referenced - so there is no evidence of active exploitation. Note a tension worth flagging: the description's language about 'malicious packets being fed' reads network-flavored, but the official vector is AV:L; this is consistent with locally injected packets rather than remote unauthenticated traffic - verify the threat model against your deployment (e.g., container/VM tenants with raw socket access raise relevance). Overall: a legitimate kernel memory-disclosure/DoS bug, but low immediate-exploitation risk; prioritize via normal kernel patch cycles, higher if you run untrusted local tenants.
Exploit ScenarioDerived

A local user or compromised container with raw/packet socket access (CAP_NET_RAW) crafts a GSO packet whose protocol headers sit in paged fragments rather than the skb linear area, then transmits it through an interface so it hits the qdisc segmentation path. The kernel's tso_build_hdr() memcpy reads beyond the intended header bounds, leaking adjacent kernel memory back to the attacker or panicking the host; no public POC is currently referenced, and the local attack vector with low complexity (AV:L/AC:L) makes it reliable for an attacker who already holds the required socket privileges.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Out-of-bounds memory access in the Linux kernel networking stack (net/core qdisc segmentation path) lets a local user feed malformed GSO (Generic Segmentation Offload) packets whose headers are not present in skb->head, causing drivers and net/core/tso.c (tso_build_hdr) to memcpy beyond valid bounds. The flaw can leak adjacent kernel memory and/or crash the system; it is not in CISA KEV and no public exploit has been identified, with a low EPSS of 0.15% (5th percentile) indicating low near-term exploitation likelihood. The upstream fix adds proper header pulling via pskb_may_pull() and a new SKB_DROP_REASON_SKB_BAD_GSO drop reason so malicious packets are dropped early.

RemediationAI

Upstream fix available (commits 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 and 9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a); the EUVD data indicates patched stable kernels in the 7.0.10 and 7.1 line - upgrade to your distribution's kernel build that incorporates these commits and reboot. Apply the stable patch referenced at https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 (and the companion 9d4f5c68... commit), and consult https://nvd.nist.gov/vuln/detail/CVE-2026-53091 plus your distro's tracker to map to a concrete package version, as exact distro versions are not in the provided data. Until patched, the practical compensating control is to deny untrusted/local users the ability to inject crafted GSO packets: restrict CAP_NET_RAW (drop it from containers and unprivileged service accounts), avoid granting raw/packet socket access and tun/tap device creation to untrusted tenants, and tighten container runtime capability defaults - the trade-off is that legitimate workloads needing raw sockets (packet capture, VPN/tunnel software, some virtualization paths) will break and must be explicitly exempted. There is no purely network-side filter that reliably blocks this since exploitation is local, so capability hardening is the main interim mitigation.

Affected VersionsENISA

Linux e876f208af18b074f800656e4d1b99da75b2135f <7fb4c19670110f052c04e1ec1d2b953b9f4f57e4
Linux patch: 7.0.10
Linux patch: 7.1
Linux patch: 0
Linux 3.16
Linux e876f208af18b074f800656e4d1b99da75b2135f <9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is in the kernel's traffic-control/queueing-discipline transmit path, specifically qdisc_pkt_len_segs_init(), which dissects GSO (Generic Segmentation Offload) packets before they reach a NIC driver's ndo_start_xmit(). Most drivers assume the full set of protocol headers for a GSO packet already reside in the linear part of the socket buffer (skb->head); the TSO helper net/core/tso.c performs memcpy(hdr, skb->data, hdr_len) directly against that assumption. The original code used skb_header_pointer() (which can point into non-linear/paged data) rather than pskb_may_pull() (which guarantees the bytes are linearized), so a crafted skb with headers in fragments leads to reading/copying memory outside the intended header region - an out-of-bounds read class issue (effectively CWE-125, though the record lists CWE as N/A). The CPE data scopes this to the Linux kernel project (cpe:2.3:a:linux:linux:*), and EUVD tags it as Information Disclosure, consistent with kernel memory leakage.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.4 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
vuln.today AI 8.4 HIGH

Local packet injection needing raw-socket privilege (AV:L/PR:L); over-read crosses the kernel boundary (S:C) leaking memory (C:H) and crashing the host (A:H) with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.4 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: pull headers in qdisc_pkt_len_segs_init()

Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.

net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len);

qdisc_pkt_len_segs_init() already does a dissection of gso packets.

Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this.

Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

Executive ViewAI

Why It Matters

Linux systems across your infrastructure face kernel vulnerability CVE-2026-53091 that could cause system crashes or kernel memory exposure; while high-severity, exploitation requires local system access and vendor patches are available with minimal near-term exploitation risk.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel networking code runs in nearly all server, cloud, and container environments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-131 – Incorrect Calculation of Buffer Size

View all
CVE-2024-23606 CRITICAL POC
9.8
CVE-2021-21824 CRITICAL POC
9.8
CVE-2025-66216 CRITICAL POC
9.3
CVE-2021-21793 HIGH POC
8.8
CVE-2021-21782 HIGH POC
8.8
CVE-2021-21776 HIGH POC
8.8
CVE-2023-0568 HIGH POC
8.1
CVE-2021-29608 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53091 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373367 REF https://access.redhat.com/errata/RHSA-2026:65334 REF https://access.redhat.com/errata/RHSA-2026:66324 REF https://access.redhat.com/errata/RHSA-2026:66325 REF https://access.redhat.com/errata/RHSA-2026:67150 REF https://access.redhat.com/security/cve/CVE-2026-53091 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492270 REF https://git.kernel.org/stable/c/5895cfc76924a629c6eaa5e5f049de642860045f REF https://git.kernel.org/stable/c/7564dc804d8289d2e5c6edb8173754051b71bff4 REF https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 REF https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy