Numeric Truncation Error in Linux kernel - CVE-2026-98556

Vulnerability details

The vulnerability allows a local user to submit invalid TCP segmentation offload descriptors to the network device, potentially disrupting packet transmission.

The vulnerability exists due to unchecked numeric truncation in the Linux kernel gve driver's DQO transmit path when processing packets with an out-of-range segmentation size. A local user can supply an arbitrary gso_size through virtio_net_hdr in packets forwarded from a guest through a tap interface or injected through a packet socket to exceed the device's 9728-byte MSS limit; a value of 16384 is truncated to zero in the 14-bit descriptor field, potentially disrupting packet transmission.

Affected software

How to mitigate CVE-2026-98556

External References

• https://git.kernel.org/stable/c/296c83b5ccc808c080865eb20fd7a477b0355bb7
• https://git.kernel.org/stable/c/2dc3ae3942e151fef254b7bbb65c832192ad2069
• https://git.kernel.org/stable/c/c517e8755960c8c6335ebf7dae6c95c43e5fb085

Related Security Bulletins

• Numeric Truncation Error in Linux kernel google gve driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more