In the Linux kernel, the following vulnerability has been resolved:
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment():
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1 RIP: 0010:skb_panic+0xda/0xe0 call Trace: skb_push+0x91/0xa0 nsh_gso_segment+0x4f3/0x570 skb_mac_gso_segment+0x19e/0x270 __skb_gso_segment+0x1e8/0x3c0 validate_xmit_skb+0x452/0x890 validate_xmit_skb_list+0x99/0xd0 sch_direct_xmit+0x294/0x7c0 __dev_queue_xmit+0x16f0/0x1d70 packet_xmit+0x185/0x210 packet_snd+0xc15/0x1170 packet_sendmsg+0x7b/0xa0 sock_sendmsg+0x14f/0x160
The root cause is: nsh_gso_segment() use skb->network_header - nhoff to reset mac_header in skb_gso_error_unwind() if inner-layer protocol gso fails. However, skb->network_header may be reset by inner-layer protocol gso function e.g. mpls_gso_segment. skb->mac_header reset by the inaccurate network_header will be larger than skb headroom.
nsh_gso_segment nhoff = skb->network_header - skb->mac_header; __skb_pull(skb,nsh_len) skb_mac_gso_segment mpls_gso_segment skb_reset_network_header(skb);//skb->network_header+=nsh_len return -EINVAL; skb_gso_error_unwind skb_push(skb, nsh_len); skb->mac_header = skb->network_header - nhoff; // skb->mac_header > skb->headroom, cause skb_push panic
Use correct mac_offset to restore mac_header and get rid of nhoff.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade perfUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.15.117-72.142Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-5.10.184-174.730Upgrade python-perfUpgrade python-perf-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpfUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-livepatch-6.1.34-56.100Upgrade kernel-develUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-develUpgrade perfUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade python3-perfUpgrade perf-debuginfo | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools-libs | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-nvidia-tegra-igxUpgrade linux-azure-5.15Upgrade linux-azure-5.4Upgrade linux-iotUpgrade linux-raspiUpgrade linux-ibmUpgrade linux-azure-fipsUpgrade linux-awsUpgrade linux-ibm-5.4Upgrade linux-hwe-5.15Upgrade linux-aws-5.4Upgrade linux-gcp-5.4Upgrade linux-aws-fipsUpgrade linux-azureUpgrade linux-nvidia-tegra-5.15Upgrade linux-gkeopUpgrade linux-gkeUpgrade linux-oracle-5.15Upgrade linux-lowlatencyUpgrade linux-hwe-5.4Upgrade linux-nvidia-tegraUpgrade linuxUpgrade linux-gcpUpgrade linux-fipsUpgrade linux-gcp-5.15Upgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-lowlatency-hwe-5.15Upgrade linux-oracleUpgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-intel-iotgUpgrade linux-xilinx-zynqmpUpgrade linux-intel-iot-realtimeUpgrade linux-nvidiaUpgrade linux-realtimeUpgrade linux-riscv-5.15Upgrade linux-aws-5.15Upgrade linux-ibm-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-oracle-5.4 | Jan 6, 2026 | Dec 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub