-

CVE-2026-80793

Medienbericht

ipv4: reject undersized MTUs in ip_do_fragment()

In the Linux kernel, the following vulnerability has been resolved:

ipv4: reject undersized MTUs in ip_do_fragment()

ip_do_fragment() subtracts the IPv4 header length from the effective
MTU and passes the resulting payload MTU to ip_frag_next().

If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds
the fragment payload length down to zero. The fragmentation state then
never makes forward progress: state->left, state->ptr and state->offset
stay unchanged while ip_do_fragment() keeps allocating and transmitting
header-only fragments until the softlockup detector fires.

This is reproducible with a route installed using "mtu lock 20", but it
is also reproducible without route MTU lock, for example by forwarding a
packet to a device whose MTU is 20.

Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE,
matching the existing IPv6 fragmentation check.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < a716a64a4ba68cd46f2745fba2b1099fe8e0aa59
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 515b6816ba0c12d8415c88e5f41e6ec029e35cfa
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 74ce7389f8f562d39015f59a00ef7ad6acd37803
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < b0ea911453ce7210e8200a07a94d2458bd1e6430
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 36e0741833bd823866f8cb9f112f37cea1a70b60
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < d9d1a676b033acabf8e5645f730486d1f8204a3f
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 3556beb8ca86677af2aca5bfbed6f8e790fccc83
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < c8a74adccaf028223054633b532593101dfcc581
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < c0726f0caf8c6b3208552949e17d23634a2f3129
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 2.6.12
Status affected
Version 0
Version < 2.6.12
Status unaffected
Version <= 5.10.*
Version 5.10.267
Status unaffected
Version <= 5.15.*
Version 5.15.218
Status unaffected
Version <= 6.1.*
Version 6.1.185
Status unaffected
Version <= 6.6.*
Version 6.6.154
Status unaffected
Version <= 6.12.*
Version 6.12.106
Status unaffected
Version <= 6.18.*
Version 6.18.47
Status unaffected
Version <= 7.1.*
Version 7.1.11
Status unaffected
Version <= 7.2.*
Version 7.2.1
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.093
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
08.09.2026 20:38
https://git.kernel.org/stable/c/a716a64a4ba68cd46f2745fba2b1099fe8e0aa59
https://git.kernel.org/stable/c/515b6816ba0c12d8415c88e5f41e6ec029e35cfa
https://git.kernel.org/stable/c/74ce7389f8f562d39015f59a00ef7ad6acd37803
https://git.kernel.org/stable/c/b0ea911453ce7210e8200a07a94d2458bd1e6430
https://git.kernel.org/stable/c/36e0741833bd823866f8cb9f112f37cea1a70b60
https://git.kernel.org/stable/c/d9d1a676b033acabf8e5645f730486d1f8204a3f
https://git.kernel.org/stable/c/3556beb8ca86677af2aca5bfbed6f8e790fccc83
https://git.kernel.org/stable/c/c8a74adccaf028223054633b532593101dfcc581
https://git.kernel.org/stable/c/c0726f0caf8c6b3208552949e17d23634a2f3129