Not yet scoredPublished Sep 17, 2026

CVE-2026-90063virtio-net: Ensure that TCP packets don't overflow gso_segs

Updated under an hour ago (Oct 26, 2026, 6:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gso_segs The user can specify any gso_size in a packet crafted with an AF_PACKET PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user crafts a packet with gso_size < 8, there is a risk for partial GSO to overflow the 16-bit gso_segs field when dividing the SKB length by gso_size. Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly tested at tools/testing/selftests/net/tun.c:649.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before d3d111fe809773edbb4ae121e36253b7d683509a; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before 8f6667a081887c2b59c6f3dd86c1789ada563762; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before 339f47ae04dcc6b5a730dd6bc70dddc8937c3260; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before 29bd12c7c5f9d6cf855b87bace18f71e9607f9e8; 7c6d2ecbda83150b2036a2b36b21381ad4667762 builds before 0e5ed3b98d1d8d251acfdccfeaa607453ad12954; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before 75c271c48f483af678e514734e10b2452410e08c; from 7c6d2ecbda83150b2036a2b36b21381ad4667762 before c27c449d455aafd9018a3cbab150f1c42c87923f; bfbaf151efe491e30697e21c8b7ae1b615480873; and 7 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/d3d111fe809773edbb4ae121e36253b7d683509a
https://git.kernel.org/stable/c/8f6667a081887c2b59c6f3dd86c1789ada563762
https://git.kernel.org/stable/c/339f47ae04dcc6b5a730dd6bc70dddc8937c3260
https://git.kernel.org/stable/c/29bd12c7c5f9d6cf855b87bace18f71e9607f9e8
https://git.kernel.org/stable/c/0e5ed3b98d1d8d251acfdccfeaa607453ad12954
https://git.kernel.org/stable/c/75c271c48f483af678e514734e10b2452410e08c
https://git.kernel.org/stable/c/c27c449d455aafd9018a3cbab150f1c42c87923f

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.