CVE-2026-72502

CVE CVE-2026-72502EUVD EUVD-2026-59401Published 2026-08-15T05:57:33.000ZLast changed 2026-08-17T05:45:02.000ZCVSS 7.5

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference because local TCP packets do not use frag_list. Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large. Also update the stale comment in ip6_default_advmss() which suggested that IPV6_MAXPLEN is returned to mean "any MSS".

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 3953c46c3ac7eef31a9935427371c6f54a22f1ba <21f69ac1879bb970588d5e7c12a96e6542f7c1a7; patch: 6.18.40; 3953c46c3ac7eef31a9935427371c6f54a22f1ba <a210791f33345aa87187f7d7a9f3b9b7f4a28e6d; 3953c46c3ac7eef31a9935427371c6f54a22f1ba <8e6214a530c03e341dc1b0a846c8f2b716b3551a; patch: 5.10.261; patch: 0; 3953c46c3ac7eef31a9935427371c6f54a22f1ba <c0db3dc2ac323b6c4b76adede3b355a9daa6dea8; patch: 7.1.5; 3953c46c3ac7eef31a9935427371c6f54a22f1ba <560b33b434e922ef97f9ff23aa2e909ef7aacd5c; patch: 6.1.178; 3953c46c3ac7eef31a9935427371c6f54a22f1ba <d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e; 3953c46c3ac7eef31a9935427371c6f54a22f1ba <2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22; patch: 7.2; patch: 6.12.97; patch: 5.15.212; 3953c46c3ac7eef31a9935427371c6f54a22f1ba <572fff10819dfc359298d1f774839e76a4d96f93; 4.8; patch: 6.6.145

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.