CVE-2026-23154 net: fix segmentation of forwarding fraglist GRO
A bug in Linux kernel GSO segmentation causes reduced throughput and potential service disruption when forwarding translated GRO packets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23154?
CVE-2026-23154 is a medium-severity denial of service vulnerability in Linux kernel, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: fix segmentation of forwarding fraglist GRO
This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface.
Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput.
To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT.
Weakness: CWE-20
Which versions are affected by CVE-2026-23154?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23154?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23154 being exploited?
There is no known exploitation of CVE-2026-23154 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-77676, BELL-CVE-2026-23154, DEBIAN-CVE-2026-23154, GHSA-fg9w-2hrh-3rjq, ROOT-OS-DEBIAN-11-CVE-2026-23154, ROOT-OS-DEBIAN-12-CVE-2026-23154 and 3 more.