Skip to main content

Linux Kernel CVE-2026-53091

| EUVDEUVD-2026-38959 HIGH
Incorrect Calculation of Buffer Size (CWE-131)
2026-06-24 Linux GHSA-mjfm-6cr9-5cqx
Linux Information Disclosure Red Hat Suse
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
vuln.today AI
8.4 HIGH

Local packet injection needing raw-socket privilege (AV:L/PR:L); over-read crosses the kernel boundary (S:C) leaking memory (C:H) and crashing the host (A:H) with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:10 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.4 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: pull headers in qdisc_pkt_len_segs_init()

Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.

net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len);

qdisc_pkt_len_segs_init() already does a dissection of gso packets.

Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this.

Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

AnalysisAI

Out-of-bounds memory access in the Linux kernel networking stack (net/core qdisc segmentation path) lets a local user feed malformed GSO (Generic Segmentation Offload) packets whose headers are not present in skb->head, causing drivers and net/core/tso.c (tso_build_hdr) to memcpy beyond valid bounds. The flaw can leak adjacent kernel memory and/or crash the system; it is not in CISA KEV and no public exploit has been identified, with a low EPSS of 0.15% (5th percentile) indicating low near-term exploitation likelihood. The upstream fix adds proper header pulling via pskb_may_pull() and a new SKB_DROP_REASON_SKB_BAD_GSO drop reason so malicious packets are dropped early.

Technical ContextAI

The vulnerability is in the kernel's traffic-control/queueing-discipline transmit path, specifically qdisc_pkt_len_segs_init(), which dissects GSO (Generic Segmentation Offload) packets before they reach a NIC driver's ndo_start_xmit(). Most drivers assume the full set of protocol headers for a GSO packet already reside in the linear part of the socket buffer (skb->head); the TSO helper net/core/tso.c performs memcpy(hdr, skb->data, hdr_len) directly against that assumption. The original code used skb_header_pointer() (which can point into non-linear/paged data) rather than pskb_may_pull() (which guarantees the bytes are linearized), so a crafted skb with headers in fragments leads to reading/copying memory outside the intended header region - an out-of-bounds read class issue (effectively CWE-125, though the record lists CWE as N/A). The CPE data scopes this to the Linux kernel project (cpe:2.3:a:linux:linux:*), and EUVD tags it as Information Disclosure, consistent with kernel memory leakage.

RemediationAI

Upstream fix available (commits 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 and 9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a); the EUVD data indicates patched stable kernels in the 7.0.10 and 7.1 line - upgrade to your distribution's kernel build that incorporates these commits and reboot. Apply the stable patch referenced at https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 (and the companion 9d4f5c68... commit), and consult https://nvd.nist.gov/vuln/detail/CVE-2026-53091 plus your distro's tracker to map to a concrete package version, as exact distro versions are not in the provided data. Until patched, the practical compensating control is to deny untrusted/local users the ability to inject crafted GSO packets: restrict CAP_NET_RAW (drop it from containers and unprivileged service accounts), avoid granting raw/packet socket access and tun/tap device creation to untrusted tenants, and tighten container runtime capability defaults - the trade-off is that legitimate workloads needing raw sockets (packet capture, VPN/tunnel software, some virtualization paths) will break and must be explicitly exempted. There is no purely network-side filter that reliably blocks this since exploitation is local, so capability hardening is the main interim mitigation.

Same weakness CWE-131 – Incorrect Calculation of Buffer Size

View all
CVE-2024-23606 CRITICAL POC
9.8
CVE-2021-21824 CRITICAL POC
9.8
CVE-2025-66216 CRITICAL POC
9.3
CVE-2021-21793 HIGH POC
8.8
CVE-2021-21782 HIGH POC
8.8
CVE-2021-21776 HIGH POC
8.8
CVE-2023-0568 HIGH POC
8.1
CVE-2021-29608 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53091 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy