HIGH Introduced in 3.13
net/gso IPIP StackExhaustion
CVE-2026-98853
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stack. Making inet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP GSO/TSO later made the path reachable. The IPv6 stackable path was introduced separately and uses the same guard. Count IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once per top-level GSO operation and preserved across GRE/UDP context changes. Use the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first five entries pass, and the sixth returns -EINVAL before dispatching another GSO callback.
02KernelScan AI Analysis
Risk summary
A remote attacker can crash the kernel by sending a crafted packet with deeply nested IP-in-IP headers to any system that processes IP-in-IP tunnels. The unbounded recursion in the GSO segmentation path exhausts the kernel stack, causing a denial of service. No authentication or local access is required.
Vulnerability analysis
The Linux kernel's Generic Segmentation Offload (GSO) path for IP-in-IP encapsulated packets allows unbounded recursion when processing deeply nested IP headers. The existing encapsulation level counter tracks header bytes rather than callback depth, so a packet with many layers of IP-in-IP tunneling causes repeated re-entry into the IPv4 or IPv6 GSO segment functions, eventually exhausting the kernel stack and crashing the system. The fix introduces a per-packet recursion counter initialized at the start of each GSO operation and checked on every entry to the IPv4 and IPv6 segment handlers; once the limit of five nested levels is exceeded, further segmentation is aborted with an error. This vulnerability can be triggered remotely by any attacker who can send a crafted IP-in-IP packet to a system that processes such tunnels, requiring no privileges or local access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 3.13 | 7.2.10 | c949646c900e |
| mainline | 3.13 | 7.3 | 006c8b834aed |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |