---
id: CVE-2026-43036
title: 'net: use skb_header_pointer() for TCPv4 GSO frag_off check'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: use skb_header_pointer() for TCPv4 GSO frag_off check

  Syzbot reported a KMSAN uninit-value warning in gso_features_check()
  called from netif_skb_features() [1].

  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d <
    5057502630fbc8ce468ff617ff59af275960b537
  - >-
    Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d <
    f7a6cd508e9e825a2c69fa9e13d41ee156852f25
  - >-
    Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d <
    cc91202fc20a44aab4c206f12a2bfe05da936051
  - >-
    Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d <
    d970341cfa5594614c7a6634886c7688b4f5cafd
  - >-
    Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d <
    ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0
  - Linux 4.7
published: '2026-05-01'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:54.503Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43036'
references:
  - url: 'https://git.kernel.org/stable/c/5057502630fbc8ce468ff617ff59af275960b537'
  - url: 'https://git.kernel.org/stable/c/f7a6cd508e9e825a2c69fa9e13d41ee156852f25'
  - url: 'https://git.kernel.org/stable/c/cc91202fc20a44aab4c206f12a2bfe05da936051'
  - url: 'https://git.kernel.org/stable/c/d970341cfa5594614c7a6634886c7688b4f5cafd'
  - url: 'https://git.kernel.org/stable/c/ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01816
ingestedAt: '2026-10-21T12:48:53.651Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: use skb_header_pointer() for TCPv4 GSO frag_off check

Syzbot reported a KMSAN uninit-value warning in gso_features_check()
called from netif_skb_features() [1].

gso_features_check() reads iph->frag_off to decide whether to clear
mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr()
can rely on skb header offsets that are not always safe for direct
dereference on packets injected from PF_PACKET paths.

Use skb_header_pointer() for the TCPv4 frag_off check so the header read
is robust whether data is already linear or needs copying.

[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407

## Affected

- `Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d < 5057502630fbc8ce468ff617ff59af275960b537`
- `Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d < f7a6cd508e9e825a2c69fa9e13d41ee156852f25`
- `Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d < cc91202fc20a44aab4c206f12a2bfe05da936051`
- `Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d < d970341cfa5594614c7a6634886c7688b4f5cafd`
- `Linux >= cbc53e08a793b073e79f42ca33f1f3568703540d < ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0`
- `Linux 4.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.