CVE-2026-53091

Aliases:UBUNTU-CVE-2026-53091DEBIAN-CVE-2026-53091CGA-2jp2-3v53-cw87CGA-2qfc-ph22-37vgCGA-45fw-xv39-mqm5CGA-6gqh-c349-c94rCGA-74cr-gc62-52pcCGA-9qjx-jj3w-6rw3CGA-hph4-53p2-w52pCGA-jgv7-wfrr-2225CGA-m23p-q479-rgmmCGA-pxcg-8x79-mf96CGA-q985-273q-m957CGA-vcc9-3c7j-72wrCGA-wqjr-w6vv-6898CGA-x7qc-v52g-88wvCGA-24f9-gp3x-9288CGA-6pwh-vj6g-prfqCGA-22vg-5wgh-2m9fCGA-27q4-r362-8px5CGA-2fp3-w3r9-gpp7CGA-2gch-jx2j-49mxCGA-2w8q-w6rr-8jm2CGA-37hv-qh82-hm5rCGA-3c88-895m-98h7CGA-3rg3-hhrj-x7wqCGA-3rxp-rp93-xwr4CGA-4f8q-cfm4-9425CGA-4g36-33vv-q9f3CGA-4m5p-w6qg-xw72CGA-4p5h-528m-qx57CGA-4q24-qcjr-73whCGA-53q7-3w8x-xm7pCGA-5843-8q3x-q6ggCGA-5f2q-r5g9-mfq4CGA-5ggm-qj2c-qcggCGA-5v75-7rjv-cxxxCGA-6298-rc4f-f8ggCGA-6r43-rw76-fpp3CGA-6xc2-g38r-q9mwCGA-788f-h8gq-6fh5CGA-7p47-whjw-rc92CGA-7rp3-hv4w-7cf2CGA-8454-vjph-rr9vCGA-8589-xj9g-x86pCGA-87r9-6g5f-jhpwCGA-8jcj-g55c-g2xmCGA-9782-p49w-g4rfCGA-9hm4-gj8r-pfqvCGA-9rcf-pv7g-462fCGA-cfg4-hqf7-fg33CGA-cm9j-c2q6-g8mxCGA-cxrf-cg4p-6h2mCGA-f48g-447g-62gcCGA-fqrv-42j9-f5gmCGA-fv57-7vx6-xc7mCGA-fw8g-9gxv-q35pCGA-g4v2-fj6j-m62pCGA-gfp4-g2h7-fm48CGA-gjp5-jj44-6jg6CGA-gp2f-fvxc-vv8cCGA-gwgp-rhh7-mxjfCGA-hg3f-h24m-r7gvCGA-j39f-293f-6xg5CGA-j58j-qxcm-x28xCGA-jgqh-8pf5-ch9xCGA-jvcg-c3q2-9vv3CGA-jvgq-vm2c-5gm5CGA-m7mq-77pv-p5mmCGA-mpc7-c9rv-c4wwCGA-mx86-2fvg-mp5cCGA-pp77-pwhv-x2pvCGA-pv2m-xr55-cmchCGA-q789-fgf3-v5x7CGA-qfmv-4pg8-pxq4CGA-qhrf-g5v5-v482CGA-qj48-564g-g4jfCGA-qm9c-73rv-r8f3CGA-qp67-v4xj-jwvgCGA-qrmc-gr26-mjgxCGA-qv3v-fp63-rx99CGA-qx4p-77gm-r6xxCGA-r4j7-g2x9-gw5qCGA-r823-3fq8-9vfhCGA-rq36-rfpm-jq9fCGA-v6v4-32mw-qrwpCGA-w8hp-m379-ccqmCGA-w9wf-q9hw-cw63CGA-wfpx-3r4h-f43wCGA-x6jj-rj8h-c3j4CGA-xmv2-wpq3-65r4CGA-xv7h-669g-xjx2CGA-w48j-f7mf-72vrCGA-www4-mjvw-qvg3
Advisory lineage Upstream: 0 Downstream: 22
Modified
Published: 24 Jun 2026, 16:30
Last modified:14 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
34/100
CVSS Score
8.4 HIGH
v3.1 (cve.org)
EPSS Score
0.14% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 Jun 2026, 16:30
Published
Vulnerability first disclosed
14 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 8.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

EPSS Trends

Current EPSS score: 0.14%• Percentile: 3%

Techniques & Countermeasures

  • CWE-131•Incorrect Calculation of Buffer Size

    The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Affected Systems

  • chainguard•hyperv-daemons-6.18

    all

  • chainguard•linux-aws-6.12

    all

  • chainguard•linux-aws-6.18

    all

  • chainguard•linux-aws-6.18-boot-installed

    all

  • chainguard•linux-aws-6.18-bootc

    all

  • chainguard•linux-aws-6.18-bootc-boot-installed

    all

  • chainguard•linux-aws-6.18-fips-boot-installed

    all

  • chainguard•linux-aws-6.18-headers

    all

  • chainguard•linux-aws-6.18-modules

    all

  • chainguard•linux-azure-6.12

    all

  • chainguard•linux-azure-6.18

    all

  • chainguard•linux-azure-6.18-boot-installed

    all

  • chainguard•linux-azure-6.18-fips-boot-installed

    all

  • chainguard•linux-azure-6.18-headers

    all

  • chainguard•linux-azure-6.18-modules

    all

  • chainguard•linux-desktop-6.18

    all

  • chainguard•linux-desktop-6.18-bootc

    all

  • chainguard•linux-desktop-6.18-bootc-boot-installed

    all

  • chainguard•linux-desktop-6.18-headers

    all

  • chainguard•linux-desktop-6.18-modules

    all

  • chainguard•linux-firecracker-6.18

    all

  • chainguard•linux-gcp-6.12

    all

  • chainguard•linux-gcp-6.18

    all

  • chainguard•linux-gcp-6.18-boot-installed

    all

  • chainguard•linux-gcp-6.18-bootc

    all

  • chainguard•linux-gcp-6.18-bootc-boot-installed

    all

  • chainguard•linux-gcp-6.18-fips-boot-installed

    all

  • chainguard•linux-gcp-6.18-headers

    all

  • chainguard•linux-gcp-6.18-modules

    all

  • chainguard•linux-qemu-6.12

    all

  • chainguard•linux-qemu-6.18

    all

  • chainguard•linux-qemu-6.18-boot-installed

    all

  • chainguard•linux-qemu-6.18-bootc

    all

  • chainguard•linux-qemu-6.18-bootc-boot-installed

    all

  • chainguard•linux-qemu-6.18-fips-boot-installed

    all

  • chainguard•linux-qemu-6.18-headers

    all

  • chainguard•linux-qemu-6.18-modules

    all

  • chainguard•linux-qemu-melange

    all | < 6.18.49-r2

  • chainguard•linux-vmware-6.12

    all

  • chainguard•linux-vmware-6.18

    all

  • chainguard•linux-vmware-6.18-boot-installed

    all

  • chainguard•linux-vmware-6.18-fips-boot-installed

    all

  • chainguard•linux-vmware-6.18-headers

    all

  • chainguard•linux-vmware-6.18-modules

    all

  • debian•linux

    all | all | all | < 7.0.10-1

  • ubuntu•linux

    all | all | all | all | < 7.0.0-28.28

  • ubuntu•linux-allwinner-5.19

    all

  • ubuntu•linux-aws

    all | all | all | all | < 7.0.0-1009.9

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

Showing first 50 affected entries in server-rendered view.

References (26)