---
id: CVE-2026-98853
title: 'net: gso: limit recursive IP-in-IP segmentation'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: gso: limit recursive IP-in-IP segmentation

  IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()
  for each nested IP header. encap_level tracks header…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3347c960295583eee3fd58e5c539fb1972fbc005 <
    c949646c900e879afce47df1b607fa320eb63bf2
  - >-
    Linux >= 3347c960295583eee3fd58e5c539fb1972fbc005 <
    006c8b834aed8b02bd8fb9fb05e9e7ead37d1763
  - Linux 3.13
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:51:02.683Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98853'
references:
  - url: 'https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2'
  - url: 'https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.462Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: gso: limit recursive IP-in-IP segmentation

IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()
for each nested IP header. encap_level tracks header bytes, not callback
depth, so a deep chain can exhaust the kernel stack. Making
inet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP
GSO/TSO later made the path reachable. The IPv6 stackable path was
introduced separately and uses the same guard.

Count IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once
per top-level GSO operation and preserved across GRE/UDP context changes.
Use the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first
five entries pass, and the sixth returns -EINVAL before dispatching
another GSO callback.

## Affected

- `Linux >= 3347c960295583eee3fd58e5c539fb1972fbc005 < c949646c900e879afce47df1b607fa320eb63bf2`
- `Linux >= 3347c960295583eee3fd58e5c539fb1972fbc005 < 006c8b834aed8b02bd8fb9fb05e9e7ead37d1763`
- `Linux 3.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.