Linux Kernel EUVD-2026-39326

The bug is in Generic Receive Offload (GRO), a kernel feature that coalesces incoming network segments into larger skbs to reduce per-packet processing cost. Specifically skb_gro_receive_list() in net/core handles list-style GRO aggregation (used by TCP, UDP fraglist, and other protocols). After IP+TCP header parsing, skb_gro_offset(skb) is non-zero, but on NICs delivering packets through napi_gro_frags() the linear header area can be empty (skb_headlen == 0) with all payload sitting in paged fragments. Calling skb_pull(skb, skb_gro_offset(skb)) decrements skb->len without changing skb->data_len, violating the skb invariant and triggering BUG_ON(skb->len < skb->data_len) inside __skb_pull(). The root cause is a missing precondition check (the data was never guaranteed pulled into the linear area), conceptually a reachable assertion / improper input validation class issue (no CWE was assigned in the source data). The UDP fraglist GRO path already had the equivalent pskb_may_pull() guard at udp_offload.c:749; the fix centralizes that guard inside skb_gro_receive_list() so all current and future callers are protected, and on failure sets NAPI_GRO_CB(skb)->flush = 1 so the skb falls back to the normal receive path instead of being held as a GRO head.