{"id":"CVE-2026-98557","title":"gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this i…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 2f855c52a2e1d3c40d186549ac46cbd88b38eb49 < feab3880a72b43913d332c06b75bb80526fa47ba","Linux >= 014c607f86abc903d7bf46e13373d89392e371fe < dc9e8964a21f20620dbfca4ef3e11eefa7be6451","Linux >= 014c607f86abc903d7bf46e13373d89392e371fe < 83769c23fb1879edc916a526ba424285033baf2d","Linux 7.1"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:18:24.415Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98557","references":[{"url":"https://git.kernel.org/stable/c/feab3880a72b43913d332c06b75bb80526fa47ba"},{"url":"https://git.kernel.org/stable/c/dc9e8964a21f20620dbfca4ef3e11eefa7be6451"},{"url":"https://git.kernel.org/stable/c/83769c23fb1879edc916a526ba424285033baf2d"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.262Z","slug":"CVE-2026-98557","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\n\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\n\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\n\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does.\n\n## Affected\n\n- `Linux >= 2f855c52a2e1d3c40d186549ac46cbd88b38eb49 < feab3880a72b43913d332c06b75bb80526fa47ba`\n- `Linux >= 014c607f86abc903d7bf46e13373d89392e371fe < dc9e8964a21f20620dbfca4ef3e11eefa7be6451`\n- `Linux >= 014c607f86abc903d7bf46e13373d89392e371fe < 83769c23fb1879edc916a526ba424285033baf2d`\n- `Linux 7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}