Not yet scoredPublished Sep 4, 2026

CVE-2026-80793ipv4: reject undersized MTUs in ip_do_fragment()

Updated under an hour ago (Oct 28, 2026, 12:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a716a64a4ba68cd46f2745fba2b1099fe8e0aa59; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 515b6816ba0c12d8415c88e5f41e6ec029e35cfa; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 74ce7389f8f562d39015f59a00ef7ad6acd37803; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b0ea911453ce7210e8200a07a94d2458bd1e6430; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 36e0741833bd823866f8cb9f112f37cea1a70b60; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d9d1a676b033acabf8e5645f730486d1f8204a3f; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3556beb8ca86677af2aca5bfbed6f8e790fccc83; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c8a74adccaf028223054633b532593101dfcc581; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/a716a64a4ba68cd46f2745fba2b1099fe8e0aa59
https://git.kernel.org/stable/c/515b6816ba0c12d8415c88e5f41e6ec029e35cfa
https://git.kernel.org/stable/c/74ce7389f8f562d39015f59a00ef7ad6acd37803
https://git.kernel.org/stable/c/b0ea911453ce7210e8200a07a94d2458bd1e6430
https://git.kernel.org/stable/c/36e0741833bd823866f8cb9f112f37cea1a70b60
https://git.kernel.org/stable/c/d9d1a676b033acabf8e5645f730486d1f8204a3f
https://git.kernel.org/stable/c/3556beb8ca86677af2aca5bfbed6f8e790fccc83
https://git.kernel.org/stable/c/c8a74adccaf028223054633b532593101dfcc581
https://git.kernel.org/stable/c/c0726f0caf8c6b3208552949e17d23634a2f3129

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.