{"id":"CVE-2026-98557","kind":"vulnerability","aliases":["CVE-2026-98557"],"related":[],"title":"Linux kernel gve driver: wrong header length for UDP GSO packets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every segment.\n\nIt unconditionally uses skb_tcp_all_headers(), which reads the doff\nfield of the TCP header. SKB_GSO_UDP_L4 packets have no TCP header:\ntcp_hdrlen() then reads one byte of the UDP payload, and header_len\ncan be anything in [0, 60] instead of the transport offset plus the\neight bytes of the UDP header that gve_prep_tso() programs into the\nTSO context descriptor.\n\nA wrong header length shifts all the segment boundaries computed in\nthe loop, so the number of buffers per segment can be over or under\nestimated. In the first case, GSO is needlessly disabled for this\npacket by gve_features_check_dqo() and the stack has to segment it.\nIn the second case, the driver hands the device a packet whose\nsegments span more than GVE_TX_MAX_DATA_DESCS buffers.\n\nUse the UDP header length for SKB_GSO_UDP_L4 packets, matching what\ngve_prep_tso() does.","summary":"The gve network driver in the Linux kernel computes header length with the TCP header rule even for UDP GSO packets, so segment buffer counts can be wrong. The sources describe a wrong-size header causing either needless GSO disabling or a packet whose segments exceed the driver's descriptor limit.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["google-compute-engine","gve-driver","linux-kernel","runtime"],"not_affected_if":["no-gve-driver"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit fixing gve_can_send_tso() for SKB_GSO_UDP_L4 packets (the sources do not list fixed versions).","status":"open","published_at":"2026-10-18T16:17:07+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:26+00:00","updated_at":"2026-10-25T05:23:26+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:26Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit fixing gve_can_send_tso() for SKB_GSO_UDP_L4 packets (the sources do not list fixed versions).","reach":"unknown","title":"Linux kernel gve driver: wrong header length for UDP GSO packets","impact":"low","summary":"The gve network driver in the Linux kernel computes header length with the TCP header rule even for UDP GSO packets, so segment buffer counts can be wrong. The sources describe a wrong-size header causing either needless GSO disabling or a packet whose segments exceed the driver's descriptor limit.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","gve-driver","google-compute-engine"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Packets are segmented in software or a device receives oversized segment descriptors","analyst_note":"Check the NVD entry and the upstream kernel commit for affected and fixed kernel versions and the actual security consequence beyond driver errors.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-gve-driver"],"who_is_affected":"Systems running Linux with a Google Virtual NIC (gve) driver, typically Google Compute Engine virtual machines, where UDP GSO traffic is sent through the DQO queue format. Hosts without the gve driver, or using other NICs, are not affected. The sources do not say whether the wrong count can be triggered by remote traffic or only by local senders.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":3647,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98557':14A,17A '0':182C '60':183C 'anyth':180C 'boundari':215C 'buffer':52B,112C,224C,277C 'byte':170C,192C 'case':236C,259C 'caus':65B 'check':247C 'comput':20B,37B,109C,216C 'context':205C 'count':53B 'cve':12A,15A 'data':275C 'desc':276C 'describ':59B 'descriptor':79B,206C 'devic':133C,264C 'disabl':69B,240C 'doff':150C 'dqo':92C,248C 'driver':4A,24B,32B,77B,261C 'eight':191C 'either':66B 'engin':21B 'estim':232C 'even':45B 'everi':138C 'exceed':75B 'featur':246C 'field':151C 'first':235C 'fix':93C 'follow':86C 'front':136C 'googl':19B 'google-compute-engin':18B 'gso':10A,48B,68B,104C,117C,157C,237C,285C 'gve':3A,23B,30B,91C,98C,105C,198C,245C,272C,291C 'gve-driv':22B 'hand':262C 'hdrlen':166C 'header':6A,38B,43B,64B,94C,130C,146C,155C,164C,176C,196C,209C,281C 'instead':184C 'kernel':2A,27B,36B,84C 'l4':159C,287C 'len':177C 'length':7A,39B,95C,127C,210C,282C 'limit':80B 'linux':1A,26B,35B,83C 'linux-kernel':25B 'loop':219C 'mani':111C 'match':289C 'max':274C 'need':125C 'needless':67B,239C 'network':31B 'number':222C 'offset':188C 'one':169C 'packet':11A,49B,72B,118C,160C,243C,266C,288C 'payload':174C 'per':225C 'plus':189C 'prep':199C,292C 'program':201C 'read':148C,168C 'replic':134C 'resolv':90C 'rule':44B 'runtim':28B 'second':258C 'segment':51B,74B,114C,139C,214C,226C,254C,268C 'send':100C,107C 'shift':211C 'size':63B 'skb':143C,156C,284C 'sourc':58B 'span':120C,269C 'stack':251C 'tcp':42B,144C,154C,163C,165C 'transport':187C 'tso':101C,108C,200C,204C,293C 'tx':273C 'udp':9A,47B,103C,158C,173C,195C,280C,286C 'uncondit':141C 'use':96C,142C,278C 'vulner':87C 'whose':73B,267C 'would':119C 'wrong':5A,56B,62B,208C 'wrong-siz':61B","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux with a Google Virtual NIC (gve) driver, typically Google Compute Engine virtual machines, where UDP GSO traffic is sent through the DQO queue format. Hosts without the gve driver, or using other NICs, are not affected. The sources do not say whether the wrong count can be triggered by remote traffic or only by local senders.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98557","severity":null,"published_at":"2026-10-18T16:17:07+00:00","modified_at":"2026-10-19T10:19:12+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}