# CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO

> A bug in Linux kernel GSO segmentation causes reduced throughput and potential service disruption when forwarding translated GRO packets.

- **Severity:** Medium 5.5 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 14 Feb 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-77676, BELL-CVE-2026-23154, DEBIAN-CVE-2026-23154, GHSA-fg9w-2hrh-3rjq, ROOT-OS-DEBIAN-11-CVE-2026-23154, ROOT-OS-DEBIAN-12-CVE-2026-23154, ROOT-OS-UBUNTU-2204-CVE-2026-23154, ROOT-OS-UBUNTU-2404-CVE-2026-23154, UBUNTU-CVE-2026-23154

## What is CVE-2026-23154?

CVE-2026-23154 is a medium-severity denial of service vulnerability in Linux kernel, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: fix segmentation of forwarding fraglist GRO

This patch enhances GSO segment handling by properly checking
the SKB_GSO_DODGY flag for frag_list GSO packets, addressing
low throughput issues observed when a station accesses IPv4
servers via hotspots with an IPv6-only upstream interface.

Specifically, it fixes a bug in GSO segmentation when forwarding
GRO packets containing a frag_list. The function skb_segment_list
cannot correctly process GRO skbs that have been converted by XLAT,
since XLAT only translates the header of the head skb. Consequently,
skbs in the frag_list may remain untranslated, resulting in protocol
inconsistencies and reduced throughput.

To address this, the patch explicitly sets the SKB_GSO_DODGY flag
for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers
(bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO
packets as potentially modified after protocol translation. As a
result, GSO segmentation will avoid using skb_segment_list and
instead falls back to skb_segment for packets with the SKB_GSO_DODGY
flag. This ensures that only safe and fully translated frag_list
packets are processed by skb_segment_list, resolving protocol
inconsistencies and improving throughput when forwarding GRO packets
converted by XLAT.

Weakness: CWE-20 (Improper Input Validation)

## Which versions are affected by CVE-2026-23154?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2026-23154?

Apply the vendor's patch.

## Is CVE-2026-23154 being exploited?

There is no known exploitation of CVE-2026-23154 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-23154 and fix it if it is affected.

What it is: CVE-2026-23154 is a medium-severity denial of service vulnerability in Linux kernel, published on 14 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-23154 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-23154/ (Markdown: https://insights.sbomify.com/CVE-2026-23154/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-23154
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-23154
- OSV: https://osv.dev/vulnerability/CVE-2026-23154

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-23154/
Summaries are generated and may contain mistakes; the official description above is the record.