In the Linux kernel, the following vulnerability has been resolved:
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment():
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1 RIP: 0010:skb_panic+0xda/0xe0 call Trace: skb_push+0x91/0xa0 nsh_gso_segment+0x4f3/0x570 skb_mac_gso_segment+0x19e/0x270 __skb_gso_segment+0x1e8/0x3c0 validate_xmit_skb+0x452/0x890 validate_xmit_skb_list+0x99/0xd0 sch_direct_xmit+0x294/0x7c0 __dev_queue_xmit+0x16f0/0x1d70 packet_xmit+0x185/0x210 packet_snd+0xc15/0x1170 packet_sendmsg+0x7b/0xa0 sock_sendmsg+0x14f/0x160
The root cause is: nsh_gso_segment() use skb->network_header - nhoff to reset mac_header in skb_gso_error_unwind() if inner-layer protocol gso fails. However, skb->network_header may be reset by inner-layer protocol gso function e.g. mpls_gso_segment. skb->mac_header reset by the inaccurate network_header will be larger than skb headroom.
nsh_gso_segment nhoff = skb->network_header - skb->mac_header; __skb_pull(skb,nsh_len) skb_mac_gso_segment mpls_gso_segment skb_reset_network_header(skb);//skb->network_header+=nsh_len return -EINVAL; skb_gso_error_unwind skb_push(skb, nsh_len); skb->mac_header = skb->network_header - nhoff; // skb->mac_header > skb->headroom, cause skb_push panic
Use correct mac_offset to restore mac_header and get rid of nhoff.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.15.117-72.142Upgrade python-perfUpgrade kernelUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.184-174.730Upgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade bpftool | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade kernel-headersUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade perfUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-libbpf-staticUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade kernel-libbpfUpgrade kernel-livepatch-6.1.34-56.100Upgrade kernel-debuginfo-common-x86_64 | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-iotUpgrade linux-azureUpgrade linux-gcp-5.4Upgrade linux-nvidia-tegraUpgrade linux-gkeopUpgrade linux-azure-fipsUpgrade linux-oracle-5.15Upgrade linux-lowlatencyUpgrade linux-aws-5.4Upgrade linux-hwe-5.4Upgrade linux-aws-fipsUpgrade linux-hwe-5.15Upgrade linux-awsUpgrade linux-ibm-5.4Upgrade linux-azure-5.4Upgrade linux-raspiUpgrade linux-nvidia-tegra-igxUpgrade linux-nvidia-tegra-5.15Upgrade linux-gkeUpgrade linux-azure-5.15Upgrade linuxUpgrade linux-ibmUpgrade linux-raspi-5.4Upgrade linux-fipsUpgrade linux-gcp-5.15Upgrade linux-oracleUpgrade linux-oracle-5.4Upgrade linux-aws-5.15Upgrade linux-realtimeUpgrade linux-intel-iotg-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-intel-iot-realtimeUpgrade linux-kvmUpgrade linux-lowlatency-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-gcpUpgrade linux-nvidiaUpgrade linux-riscv-5.15Upgrade linux-ibm-5.15 | Jan 6, 2026 | Dec 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub