CVE-2026-46273: Linux ibmveth Adapter Freeze with Small Packet Segments

Technical summary

CVE-2026-46273 addresses a hardware limitation in IBM POWER system network adapters (ibmveth) that manifests when Generic Segmentation Offload (GSO) is applied to packets with a Maximum Segment Size (MSS) below 224 bytes. The physical adapter's Large Segmentation Offload (LSO) implementation cannot process such small segments correctly, resulting in adapter failure. The vulnerability is resolved by adding an ndo_features_check callback to the ibmveth driver that disables GSO for packets meeting the problematic criteria (MSS < 224 bytes, gso_segs > 1). Single-segment packets bypass the LSO code path and are unaffected. The fix also integrates vlan_features_check() to handle VLAN and QinQ configurations properly, ensuring offload features align with hardware capabilities across different packet encapsulation scenarios.

Business impact

Organizations running Power-based Linux systems relying on ibmveth network adapters face intermittent complete network outages when the adapter encounters specific traffic patterns—particularly in cloud or virtualized environments where MSS negotiation may result in small segment sizes. These outages require manual adapter reset, disrupting service availability and requiring out-of-band intervention. The impact is heightened in production environments with QinQ VLAN configurations or systems subjected to firewall rules that modify MSS values. Until patched, affected systems become unreliable for mission-critical workloads, with potential data transfer interruptions and operational overhead from manual recovery procedures.

Affected systems

The vulnerability affects Linux kernel installations running on IBM POWER systems that use the ibmveth driver for network connectivity. This encompasses POWER7, POWER8, POWER9, and POWER10 architectures where ibmveth is the primary virtualized network interface. Affected systems include both traditional on-premises Power systems and cloud platforms offering Power instances. The issue is specific to hardware that implements LSO with the identified MSS limitation; systems using alternative network drivers or non-POWER architectures are unaffected. Virtual machines and containers on affected POWER hosts inherit the risk through inherited network device configuration.

Exploitability

The vulnerability requires no attacker action to trigger—it activates passively when legitimate network traffic encounters conditions that naturally produce small MSS values. This occurs in environments where firewall rules enforce Path MTU Discovery (PMTUD) resulting in small MSS negotiation, or in cloud environments with restrictive network segmentation. No authentication, privilege escalation, or special network access is required; any system generating traffic to a destination with constrained MSS can inadvertently trigger the adapter freeze. While not remotely exploitable in the traditional sense, the condition is easily reproducible through standard network configuration, making it a practical denial-of-service vector for anyone with network access to affected systems. The absence of an exploit prerequisite elevates the practical risk despite the targeted hardware scope.

Remediation

Apply the kernel patch that implements the ndo_features_check callback in the ibmveth driver to disable GSO for packets with MSS < 224 bytes. The patch also integrates vlan_features_check() for VLAN compatibility. Verify the patch against the vendor advisory to confirm the exact kernel versions addressed. After patching, reboot systems to activate the updated driver. No configuration changes are required post-patch; the fix operates transparently, falling back to software-based segmentation for affected packets. Testing should verify that network traffic flows normally and that no adapter resets occur during regular operations, especially in environments with QinQ VLAN configurations or systems subject to MSS constraints.

Patch guidance

Obtain the kernel update from your Linux distribution's security repository or directly from the kernel.org stable branch. The fix requires kernel rebuild and reinstallation on affected POWER systems. Coordinate patching during maintenance windows to minimize downtime, as kernel updates typically require system reboot. Prioritize systems in production environments running virtualized workloads with constrained network paths. Verify patch application by checking kernel logs for adapter initialization messages and confirming ndo_features_check registration. Test failover and high-availability configurations after patching to ensure consistent behavior across redundant systems.

Detection guidance

Monitor for repeated network adapter resets or unavailability of the ibmveth interface; these are primary symptoms of the condition. Check kernel logs (dmesg, /var/log/kern.log) for errors related to the ibmveth driver or adapter communication failures coinciding with network traffic spikes. Use packet analysis tools to identify traffic patterns producing small MSS values on outgoing connections; examine firewall rules and PMTUD configuration that may induce such conditions. Performance monitoring tools tracking network interface state transitions may reveal adapter resets. In virtualized environments, correlate adapter failures with guest OS traffic profiles and VLAN configurations. After patching, absence of these symptoms indicates successful remediation.

Why prioritize this

Although the CVSS 3.1 score of 8.6 (HIGH) reflects broad network reachability and severe availability impact, the vulnerability's scope is narrower than the score might initially suggest—limited to POWER systems using ibmveth. However, for organizations operating such infrastructure, the combination of high likelihood (passive trigger), complete availability loss (adapter freeze), and operational overhead (manual reset) mandates prompt patching. The condition is reproducible in many network environments, elevating practical risk. Organizations should prioritize based on Power system footprint: critical for those with significant POWER deployments; standard for mixed-architecture environments where POWER systems support secondary workloads.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects an attack vector that is network-based, requires no authentication, and involves low attack complexity, yielding a base score that emphasizes broad accessibility. The scope is marked as changed because the impact extends beyond the vulnerable component (adapter freeze affects all traffic on the system). The availability impact is rated severe (complete loss of network connectivity until manual intervention), while confidentiality and integrity impacts are none (no data exposure or modification occurs). The score appropriately captures the operational severity for affected Power systems but should be contextualized within organizational risk tolerance: critical for production Power infrastructure; elevated but manageable for non-critical deployments.

Frequently asked questions