In the Linux kernel, the following vulnerability has been resolved:
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment():
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1 RIP: 0010:skb_panic+0xda/0xe0 call Trace: skb_push+0x91/0xa0 nsh_gso_segment+0x4f3/0x570 skb_mac_gso_segment+0x19e/0x270 __skb_gso_segment+0x1e8/0x3c0 validate_xmit_skb+0x452/0x890 validate_xmit_skb_list+0x99/0xd0 sch_direct_xmit+0x294/0x7c0 __dev_queue_xmit+0x16f0/0x1d70 packet_xmit+0x185/0x210 packet_snd+0xc15/0x1170 packet_sendmsg+0x7b/0xa0 sock_sendmsg+0x14f/0x160
The root cause is: nsh_gso_segment() use skb->network_header - nhoff to reset mac_header in skb_gso_error_unwind() if inner-layer protocol gso fails. However, skb->network_header may be reset by inner-layer protocol gso function e.g. mpls_gso_segment. skb->mac_header reset by the inaccurate network_header will be larger than skb headroom.
nsh_gso_segment nhoff = skb->network_header - skb->mac_header; __skb_pull(skb,nsh_len) skb_mac_gso_segment mpls_gso_segment skb_reset_network_header(skb);//skb->network_header+=nsh_len return -EINVAL; skb_gso_error_unwind skb_push(skb, nsh_len); skb->mac_header = skb->network_header - nhoff; // skb->mac_header > skb->headroom, cause skb_push panic
Use correct mac_offset to restore mac_header and get rid of nhoff.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade python-perf-debuginfoUpgrade python-perfUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-livepatch-5.10.184-174.730Upgrade kernel-debuginfoUpgrade kernel-livepatch-5.15.117-72.142 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-livepatch-6.1.34-56.100Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade bpftoolUpgrade kernel-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-develUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-headersUpgrade python3-perfUpgrade perf | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-hwe-5.15Upgrade linux-ibm-5.4Upgrade linux-hwe-5.4Upgrade linux-azure-fipsUpgrade linux-gkeUpgrade linux-azure-5.15Upgrade linux-nvidia-tegra-igxUpgrade linux-azureUpgrade linuxUpgrade linux-raspiUpgrade linux-gcp-5.4Upgrade linux-gkeopUpgrade linux-awsUpgrade linux-aws-fipsUpgrade linux-iotUpgrade linux-azure-5.4Upgrade linux-aws-5.4Upgrade linux-ibmUpgrade linux-oracle-5.15Upgrade linux-lowlatencyUpgrade linux-nvidia-tegraUpgrade linux-nvidia-tegra-5.15Upgrade linux-realtimeUpgrade linux-xilinx-zynqmpUpgrade linux-ibm-5.15Upgrade linux-raspi-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-fipsUpgrade linux-intel-iotgUpgrade linux-gcp-5.15Upgrade linux-aws-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-oracle-5.4Upgrade linux-gcpUpgrade linux-fipsUpgrade linux-oracleUpgrade linux-nvidiaUpgrade linux-riscv-5.15Upgrade linux-bluefieldUpgrade linux-intel-iot-realtimeUpgrade linux-kvm | Jan 6, 2026 | Dec 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub