CVE-2026-53235: Linux Kernel GRO Denial of Service Vulnerability

Technical summary

In skb_gro_receive_list(), the function calls skb_pull(skb, skb_gro_offset(skb)) without first invoking pskb_may_pull() to ensure the required data is in the linear buffer. When skbs arrive via napi_gro_frags() with zero headlen and all data in page fragments, skb_gro_offset can be non-zero after header parsing. The unguarded skb_pull() decrements skb->len by skb_gro_offset while leaving skb->data_len unchanged, triggering BUG_ON(skb->len < skb->data_len) in __skb_pull(). The UDP fraglist GRO code at udp_offload.c:749 already contains this guard. The fix centralizes the pskb_may_pull() check in skb_gro_receive_list() itself and sets NAPI_GRO_CB(skb)->flush = 1 on failure to route the skb through the normal receive path rather than holding it as a GRO head.

Business impact

This vulnerability enables a denial-of-service condition affecting any networked Linux system. Remote attackers can craft malicious or fragmented network traffic to trigger kernel panics or system hangs on vulnerable hosts. The impact extends to cloud infrastructure, network appliances, containers, and any service relying on Linux kernel GRO optimizations. Systems supporting high-throughput network traffic or load balancing are particularly exposed. Recovery requires system reboot, causing service interruption.

Affected systems

All Linux distributions and kernel versions using the affected GRO code path are vulnerable. This includes mainstream distributions (RHEL, Ubuntu, Debian, SUSE) and embedded/mobile variants. The vulnerability affects both x86 and ARM architectures. Kernel versions without the pskb_may_pull() guard in skb_gro_receive_list() are susceptible. Check your distribution's kernel version against published advisories to determine if your system is affected—this must be verified against your vendor's CVE advisory or security bulletin.

Exploitability

Exploitability is high. No authentication or special privileges are required—an attacker need only send specially crafted network packets to a vulnerable system. The attack surface is broad: any remote network path to the target qualifies. Packets can be sent without user interaction. The CVSS 3.1 score of 7.5 (HIGH severity) reflects the network accessibility and availability impact, though there is no confidentiality or integrity compromise. Public exploit code is not required; simply forwarding appropriately structured fragmented packets suffices.

Remediation

Kernel developers must apply the fix adding pskb_may_pull() before the skb_pull() call in skb_gro_receive_list(). This matches the existing guard in the UDP fraglist GRO path and ensures data is in the linear buffer before manipulation. On check failure, set NAPI_GRO_CB(skb)->flush = 1 to route the packet normally. Linux distributions must backport this fix to all supported kernel versions. End users and operators should update to patched kernel versions provided by their distribution.

Patch guidance

Monitor your Linux distribution's security advisory channels (Red Hat Security Advisories, Ubuntu Security Notices, SUSE Security Updates, etc.) for kernel patches addressing CVE-2026-53235. Most vendors have already published patched kernel versions. Apply patches via your standard update mechanism (yum, apt, zypper, etc.) and reboot to activate the new kernel. If you maintain custom kernels, apply the pskb_may_pull() guard directly to skb_gro_receive_list() in net/core/skbuff.c and rebuild. Verify the patch version against the vendor advisory to ensure completeness.

Detection guidance

Monitor system logs for kernel BUG_ON panics or kernel oops messages mentioning __skb_pull() or skb_gro_receive_list(). In cloud environments, watch for unexpected instance crashes or auto-reboot cycles following network traffic patterns. Intrusion detection systems can flag fragmented or malformed GRO packets sent to target systems, though legitimate fragmented traffic must be carefully differentiated. Kernel performance profiling may reveal GRO processing anomalies before crashes occur. Host-based monitoring of kernel module integrity and crash dump collection aid post-incident analysis.

Why prioritize this

This vulnerability rates HIGH priority due to its network-accessible attack surface, ease of exploitation, and denial-of-service impact on critical systems. No user interaction or authentication is required. Linux systems handling significant network traffic—cloud infrastructure, load balancers, proxies, and data center hardware—face immediate risk. The broad affected population (all Linux distributions) and potential for coordinated attacks warrant rapid patching. Although no active KEV listing yet, the vulnerability's simplicity and network exposure make it attractive to attackers.

Risk score, explained

CVSS 3.1 assigns 7.5 (HIGH) due to: Network vector (AV:N)—attacks require only network access; Low complexity (AC:L)—no special conditions needed; No privilege or user interaction required (PR:N, UI:N); Scope unchanged (S:U)—impact limited to the affected system; Zero confidentiality or integrity impact (C:N, I:N); High availability impact (A:H)—kernel panic causes denial of service. The score reflects a serious but not critical threat; no data theft occurs, but service disruption is certain.

Frequently asked questions