# CVE-2026-68136: net: gro: fix double aggregation of flush-marked skbs

> A missing flush check in Linux kernel GRO allows double aggregation, corrupting packet structures and causing a kernel panic via null pointer dereference.

- **Severity:** Critical 9.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Aug 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-94919, BELL-CVE-2026-68136, DEBIAN-CVE-2026-68136, GHSA-p4gp-483j-wr28, UBUNTU-CVE-2026-68136

## What is CVE-2026-68136?

CVE-2026-68136 is a critical vulnerability in Linux, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix double aggregation of flush-marked skbs

Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO
packet.") added a flush check to skb_gro_receive(), but
skb_gro_receive_list() lacks the same validation.

As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be
re-aggregated.

This allows already-GRO'd packets with existing frag_list to be
re-aggregated into a new GRO session, corrupting the frag_list chain
structure. When skb_segment() attempts to unpack these malformed packets,
it encounters invalid state and triggers a kernel panic.

Scenario (Tethering/Device forwarding):
  1. Driver: Generated aggregated packet P1 via LRO with frag_list
  2. Dev A: Receives aggregated fraglist packet and flush flag set
  3. Dev A: Re-enters GRO, skb_gro_receive_list() is called
  4. Missing flush check allows re-aggregation despite flush flag
  5. Frag_list chain becomes corrupted (loops or dangling refs)
  6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list

Root cause in skb_segment():
  The check at line ~4891:
    if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) &&
        (skb_headlen(list_skb) == len || sg)) {

  When frag_list is corrupted by double aggregation, when list_skb is
  a NULL pointer from skb->next, skb_headlen(list_skb) dereference
  NULL/corrupted pointers occurs.

Call Trace:
 skb_headlen(NULL skb)
 skb_segment
 tcp_gso_segment
 tcp4_gso_segment
 inet_gso_segment
 skb_mac_gso_segment
 __skb_gso_segment
 skb_gso_segment
 validate_xmit_skb
 validate_xmit_skb_list
 sch_direct_xmit
 qdisc_restart
 __qdisc_run
 qdisc_run
 net_tx_action

Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in
skb_gro_receive_list(), matching the defensive programming pattern of
skb_gro_receive().

Weakness: CWE-476 (NULL Pointer Dereference)

## Which versions are affected by CVE-2026-68136?


## How do I fix CVE-2026-68136?

Apply the vendor's patch.

## Is CVE-2026-68136 being exploited?

There is no known exploitation of CVE-2026-68136 in the wild and no public exploit code.

Public exploit code:

- PoC for CVE-2026-68136 / GHSA-p4gp-483j-wr28 — Linux kernel net: gro missing flush check in skb_gro_receive_list(): double aggregation of flush-marked skbs corrupts frag_list, NULL deref in skb_segment() -> kernel panic. User-space C model, verified with ASan/UBSan. (github_poc): https://github.com/KernelEditor/CVE-2026-68136

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-68136 and fix it if it is affected.

What it is: CVE-2026-68136 is a critical vulnerability in Linux, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-68136 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-68136/ (Markdown: https://insights.sbomify.com/CVE-2026-68136/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-68136
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68136
- OSV: https://osv.dev/vulnerability/CVE-2026-68136

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-68136/
Summaries are generated and may contain mistakes; the official description above is the record.