Skip to main content

Linux Kernel CVE-2026-72502

| EUVDEUVD-2026-59401 HIGH
2026-08-15 Linux GHSA-cg8c-jghv-84p9
Denial Of Service Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

AC:H reflects the non-default large-MTU prerequisite; all other metrics from provided vector are consistent with the description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:57 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.5 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 7.5
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)

When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.

However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference because local TCP packets do not use frag_list.

Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large.

Also update the stale comment in ip6_default_advmss() which suggested that IPV6_MAXPLEN is returned to mean "any MSS".

AnalysisAI

NULL pointer dereference in the Linux kernel's TCP/IPv6 stack crashes the kernel when a system with a large-MTU interface processes oversized TCP segments whose GSO size collides with the GSO_BY_FRAGS magic value (0xFFFF). Systems running Linux kernel from commit 3953c46c onwards with jumbo-frame or high-MTU IPv6 interfaces are affected across multiple stable branches up to and including 7.1.4. A remote, unauthenticated attacker capable of establishing a TCP/IPv6 session with a vulnerable host can induce a kernel panic, causing a full denial of service. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.21%, 12th percentile).

Technical ContextAI

The root cause is a numeric collision between a legitimate protocol value and a kernel magic constant. The function ip6_default_advmss() computes the default advertised TCP Maximum Segment Size for IPv6; when the underlying interface MTU is sufficiently large, the function returns IPV6_MAXPLEN (65535, or 0xFFFF). TCP accepts this as mss_clamp, permitting the negotiated MSS to reach 65535. Separately, the kernel's Generic Segmentation Offload (GSO) subsystem uses the constant GSO_BY_FRAGS (also 0xFFFF) as a sentinel value in the gso_size field of an sk_buff to signal fragment-list-based segmentation. When a TCP packet with gso_size=0xFFFF reaches skb_segment(), the function interprets it as GSO_BY_FRAGS and attempts to process a frag_list that does not exist for locally originated TCP packets, triggering a NULL pointer dereference and kernel panic. The vulnerability is an integer-space aliasing bug - no formal CWE is assigned but it is most closely related to CWE-476 (NULL Pointer Dereference) arising from an implicit integer sentinel collision. Affected CPEs are cpe:2.3:a:linux:linux across all architectures.

RemediationAI

The primary remediation is to upgrade to a patched kernel release. Upstream fix commits are available at https://git.kernel.org/stable/c/560b33b434e922ef97f9ff23aa2e909ef7aacd5c, https://git.kernel.org/stable/c/21f69ac1879bb970588d5e7c12a96e6542f7c1a7, https://git.kernel.org/stable/c/c0db3dc2ac323b6c4b76adede3b355a9daa6dea8, https://git.kernel.org/stable/c/8e6214a530c03e341dc1b0a846c8f2b716b3551a, and related stable-branch commits. Target patched releases: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 as applicable to the running branch. For systems where kernel upgrade is not immediately feasible, a practical compensating control is to reduce the MTU of all IPv6-capable network interfaces below the threshold at which ip6_default_advmss() would return 65535 - standard 1500-byte Ethernet MTU is not affected. Disabling jumbo frames on internal interfaces (where feasible) eliminates the triggering condition at the cost of reduced throughput on high-bandwidth internal links. IPv6 cannot be disabled entirely in many environments without service impact. Patch application via distribution kernel packages (RHEL, Debian, Ubuntu, SUSE) is the preferred path and carries no known functional side effects.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72502 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy