CVE-2026-90063 virtio-net: Ensure that TCP packets don't overflow gso_segs
A local attacker can craft specific network packets to cause an integer overflow in the Linux kernel's virtio-net driver, potentially leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90063?
CVE-2026-90063 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: Ensure that TCP packets don't overflow gso_segs
The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size.
Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.
Which versions are affected by CVE-2026-90063?
How do I fix CVE-2026-90063?
Apply the vendor's patch.
Is CVE-2026-90063 being exploited?
There is no known exploitation of CVE-2026-90063 in the wild and no public exploit code.
Sources
Also known as AZL-102951, BELL-CVE-2026-90063, DEBIAN-CVE-2026-90063, GHSA-86wj-v2pm-25hq, UBUNTU-CVE-2026-90063.