CVE-2026-72351 gue: validate REMCSUM private option length
A missing length validation in the Linux kernel GUE protocol allows malformed packets to cause out-of-bounds reads, potentially leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72351?
CVE-2026-72351 is a critical denial of service vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gue: validate REMCSUM private option length
GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is accounted for by guehdr_flags_len(), but guehdr_priv_flags_len() currently returns 0 even when GUE_PFLAG_REMCSUM is set.
This lets a packet with only the private flags field pass validate_gue_flags(), after which gue_remcsum() and gue_gro_remcsum() read the missing REMCSUM start/offset fields from the following bytes.
Account for GUE_PLEN_REMCSUM when GUE_PFLAG_REMCSUM is present so that malformed packets are rejected during option validation.
Which versions are affected by CVE-2026-72351?
How do I fix CVE-2026-72351?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72351 being exploited?
There is no known exploitation of CVE-2026-72351 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72351, DEBIAN-CVE-2026-72351, GHSA-pcv5-gx25-24wj, UBUNTU-CVE-2026-72351.