Medium 5.5Published Feb 14, 2026

CVE-2026-23154net: fix segmentation of forwarding fraglist GRO

Updated under an hour ago (Oct 27, 2026, 6:10 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface. Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput. To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-20
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9fd1ff5d2ac7181844735806b0a703c942365291 before 9122d7280b2303e835cdfec156bd932ac1f586ed; 9fd1ff5d2ac7181844735806b0a703c942365291 builds before 2cbef9ea5a0ac51863ede35c45f26931a85d3888; 9fd1ff5d2ac7181844735806b0a703c942365291 builds before 3e62db1e3140449608975e29e0979cc5f3b1cc07; 9fd1ff5d2ac7181844735806b0a703c942365291 builds before 3d48d59235c494d34e32052f768393111c0806ef; from 9fd1ff5d2ac7181844735806b0a703c942365291 before 426ca15c7f6cb6562a081341ca88893a50c59fa2	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.6 before 6.12.69; from 6.13 before 6.18.9; 6.19; 6.19; 6.19; 6.19; 6.19; 6.19; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/9122d7280b2303e835cdfec156bd932ac1f586ed
https://git.kernel.org/stable/c/2cbef9ea5a0ac51863ede35c45f26931a85d3888
https://git.kernel.org/stable/c/3e62db1e3140449608975e29e0979cc5f3b1cc07	patch
https://git.kernel.org/stable/c/3d48d59235c494d34e32052f768393111c0806ef	patch
https://git.kernel.org/stable/c/426ca15c7f6cb6562a081341ca88893a50c59fa2	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.