{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43194", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.992Z", "datePublished": "2026-05-06T11:28:02.794Z", "dateUpdated": "2026-08-05T12:26:27.573Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:27.573Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: consume xmit errors of GSO frames\n\nudpgro_frglist.sh and udpgro_bench.sh are the flakiest tests\ncurrently in NIPA. They fail in the same exact way, TCP GRO\ntest stalls occasionally and the test gets killed after 10min.\n\nThese tests use veth to simulate GRO. They attach a trivial\n(\"return XDP_PASS;\") XDP program to the veth to force TSO off\nand NAPI on.\n\nDigging into the failure mode we can see that the connection\nis completely stuck after a burst of drops. The sender's snd_nxt\nis at sequence number N [1], but the receiver claims to have\nreceived (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle\nis that senders rtx queue is not empty (let's say the block in\nthe rtx queue is at sequence number N - 4 * MSS [3]).\n\nIn this state, sender sends a retransmission from the rtx queue\nwith a single segment, and sequence numbers N-4*MSS:N-3*MSS [3].\nReceiver sees it and responds with an ACK all the way up to\nN + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA\nbecause it has no recollection of ever sending data that far out [1].\nAnd we are stuck.\n\nThe root cause is the mess of the xmit return codes. veth returns\nan error when it can't xmit a frame. We end up with a loss event\nlike this:\n\n -------------------------------------------------\n | GSO super frame 1 | GSO super frame 2 |\n |-----------------------------------------------|\n | seg | seg | seg | seg | seg | seg | seg | seg |\n | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |\n -------------------------------------------------\n x ok ok | ok ok ok \n \\\\\n\t\t\t snd_nxt\n\n\"x\" means packet lost by veth, and \"ok\" means it went thru.\nSince veth has TSO disabled in this test it sees individual segments.\nSegment 1 is on the retransmit queue and will be resent.\n\nSo why did the sender not advance snd_nxt even tho it clearly did\nsend up to seg 8? tcp_write_xmit() interprets the return code\nfrom the core to mean that data has not been sent at all. Since\nTCP deals with GSO super frames, not individual segment the crux\nof the problem is that loss of a single segment can be interpreted\nas loss of all. TCP only sees the last return code for the last\nsegment of the GSO frame (in <> brackets in the diagram above).\n\nOf course for the problem to occur we need a setup or a device\nwithout a Qdisc. Otherwise Qdisc layer disconnects the protocol\nlayer from the device errors completely.\n\nWe have multiple ways to fix this.\n\n 1) make veth not return an error when it lost a packet.\n While this is what I think we did in the past, the issue keeps\n reappearing and it's annoying to debug. The game of whack\n a mole is not great.\n\n 2) fix the damn return codes\n We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the\n documentation, so maybe we should make the return code from\n ndo_start_xmit() a boolean. I like that the most, but perhaps\n some ancient, not-really-networking protocol would suffer.\n\n 3) make TCP ignore the errors\n It is not entirely clear to me what benefit TCP gets from\n interpreting the result of ip_queue_xmit()? Specifically once\n the connection is established and we're pushing data - packet\n loss is just packet loss?\n\n 4) this fix\n Ignore the rc in the Qdisc-less+GSO case, since it's unreliable.\n We already always return OK in the TCQ_F_CAN_BYPASS case.\n In the Qdisc-less case let's be a bit more conservative and only\n mask the GSO errors. This path is taken by non-IP-\"networks\"\n like CAN, MCTP etc, so we could regress some ancient thing.\n This is the simplest, but also maybe the hackiest fix?\n\nSimilar fix has been proposed by Eric in the past but never committed\nbecause original reporter was working with an OOT driver and wasn't\nproviding feedback (see Link)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable path is the generic TCP/IP transmit path and is reachable when a remote peer causes a network-facing service or container to send GSO-sized TCP data over a noqueue virtual device such as veth. A plausible internet-facing container deployment can hit this through ordinary network traffic.\nAC:L - Triggering requires GSO transmission plus lower-device drops in the noqueue path, which can be induced with repeated large transfers or queue pressure in veth/XDP/GRO-style deployments. There is no attacker-uncontrolled race or memory-layout dependency.\nPR:N - A remote attacker only needs network access to the service and can elicit outbound TCP data without kernel privileges or a local account. No capability check gates the vulnerable transmit path once the service sends data.\nUI:N - No victim user action is required beyond the already-running network service processing traffic. The attacker can repeatedly initiate the relevant network exchanges.\nS:U - The impact remains within the same kernel/networking security authority. This is not a VM escape, IOMMU bypass, or cross-scope isolation break.\nC:N - The bug is incorrect transmit error propagation/accounting after GSO segmentation, not a memory disclosure or memory corruption flaw. I found no read primitive or exposure of sensitive data.\nI:N - The failure leaves TCP send state inconsistent but does not corrupt kernel memory or allow attacker-controlled data modification. I found no write primitive, type confusion, or control-flow impact.\nA:H - Partial GSO transmission errors can leave TCP connections permanently stuck because ACKs for actually delivered data are rejected as TCP_ACK_UNSENT_DATA after snd_nxt was not advanced. Repeated unauthenticated triggering can stall or exhaust service connections, causing a high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/dev.c" ], "versions": [ { "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "ae3f627b45fbc3c776a4e484696f3cad7cbb4eca", "status": "affected", "versionType": "git" }, { "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "0c9de092ef8c50a7ee9612811566f0aa81d8d7b6", "status": "affected", "versionType": "git" }, { "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "56bd32c0edca34041a5c215887fcf562fae2e2db", "status": "affected", "versionType": "git" }, { "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "9ac6aebef4b4bfc5ed408b0b65645981574bc780", "status": "affected", "versionType": "git" }, { "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "ea5d7787635e26ec1194ec7eec0e8e5ae3bd10a5", "status": "affected", "versionType": "git" }, { "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "4cb163e9efcac4cd35c3043e097f25081a5c015c", "status": "affected", "versionType": "git" }, { "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "c86901d22c89a6bf4e2f013e948aaabc60869893", "status": "affected", "versionType": "git" }, { "version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501", "lessThan": "7aa767d0d3d04e50ae94e770db7db8197f666970", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/dev.c" ], "versions": [ { "version": "3.18", "status": "affected" }, { "version": "0", "lessThan": "3.18", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.252", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "5.10.252" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "5.15.202" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.1.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.6.128" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.12.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.18.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.19.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ae3f627b45fbc3c776a4e484696f3cad7cbb4eca" }, { "url": "https://git.kernel.org/stable/c/0c9de092ef8c50a7ee9612811566f0aa81d8d7b6" }, { "url": "https://git.kernel.org/stable/c/56bd32c0edca34041a5c215887fcf562fae2e2db" }, { "url": "https://git.kernel.org/stable/c/9ac6aebef4b4bfc5ed408b0b65645981574bc780" }, { "url": "https://git.kernel.org/stable/c/ea5d7787635e26ec1194ec7eec0e8e5ae3bd10a5" }, { "url": "https://git.kernel.org/stable/c/4cb163e9efcac4cd35c3043e097f25081a5c015c" }, { "url": "https://git.kernel.org/stable/c/c86901d22c89a6bf4e2f013e948aaabc60869893" }, { "url": "https://git.kernel.org/stable/c/7aa767d0d3d04e50ae94e770db7db8197f666970" } ], "title": "net: consume xmit errors of GSO frames", "x_generator": { "engine": "bippy-1.2.0" } } } }