Linux Kernel up to 7.0.9 net net/core/tso.c qdisc_pkt_len_segs_init head information disclosure

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 7.0.9. Impacted is the function qdisc_pkt_len_segs_init of the file net/core/tso.c of the component net. The manipulation of the argument head leads to information disclosure. This vulnerability is uniquely identified as CVE-2026-53091. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.0.9. This issue affects the function qdisc_pkt_len_segs_init of the file net/core/tso.c of the component net. The manipulation of the argument head with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-53091 since 06/09/2026. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/30/2026). The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 7.0.10 eliminates this vulnerability. Applying the patch 9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2077). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion