SB20261022133 - Numeric Truncation Error in Linux kernel google gve driver

Description

This security bulletin contains information about 1 vulnerability.

1) Numeric Truncation Error (CVE-ID: CVE-2026-98556)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to submit invalid TCP segmentation offload descriptors to the network device, potentially disrupting packet transmission.

The vulnerability exists due to unchecked numeric truncation in the Linux kernel gve driver's DQO transmit path when processing packets with an out-of-range segmentation size. A local user can supply an arbitrary gso_size through virtio_net_hdr in packets forwarded from a guest through a tap interface or injected through a packet socket to exceed the device's 9728-byte MSS limit; a value of 16384 is truncated to zero in the 14-bit descriptor field, potentially disrupting packet transmission.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/296c83b5ccc808c080865eb20fd7a477b0355bb7
• https://git.kernel.org/stable/c/2dc3ae3942e151fef254b7bbb65c832192ad2069
• https://git.kernel.org/stable/c/c517e8755960c8c6335ebf7dae6c95c43e5fb085