Integer overflow in Linux kernel - CVE-2026-90063
Published: September 19, 2026
Vulnerability identifier: #VU151414
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90063
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a 16-bit gso_segs field overflow.
The vulnerability exists due to improper validation of gso_size in virtio_net_hdr_to_skb when processing TCP packets crafted through an AF_PACKET PACKET_VNET_HDR socket. A local user can submit a TCP packet with a gso_size smaller than TCP_MIN_GSO_SIZE to cause a 16-bit gso_segs field overflow.
The condition applies to TCP packets; UDP GSO permits a gso_size of 1.
Affected software
Linux kernel
How to mitigate CVE-2026-90063
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/0e5ed3b98d1d8d251acfdccfeaa607453ad12954
- https://git.kernel.org/stable/c/29bd12c7c5f9d6cf855b87bace18f71e9607f9e8
- https://git.kernel.org/stable/c/339f47ae04dcc6b5a730dd6bc70dddc8937c3260
- https://git.kernel.org/stable/c/75c271c48f483af678e514734e10b2452410e08c
- https://git.kernel.org/stable/c/8f6667a081887c2b59c6f3dd86c1789ada563762
- https://git.kernel.org/stable/c/c27c449d455aafd9018a3cbab150f1c42c87923f
- https://git.kernel.org/stable/c/d3d111fe809773edbb4ae121e36253b7d683509a