LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO

In the Linux kernel, the following vulnerability has been resolved: net: fix segmentation of forwarding fraglist GRO This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface. Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput. To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects specific packet forwarding paths that translate between IPv4 and IPv6. The reported impact is protocol inconsistency and reduced throughput, especially in hotspot or IPv6-only upstream scenarios. The source bundle does not provide CVSS, CWE, or evidence of compromise.

Executive priority

Treat as a targeted infrastructure maintenance item, not an emergency, unless affected systems are business-critical gateways. Prioritize validation and patch planning for Linux-based network appliances or embedded products that depend on IPv4/IPv6 translation.

Technical view

The bug is in GSO segmentation of forwarded GRO packets with frag_list after XLAT conversion. XLAT may translate only the head skb, leaving frag_list skbs inconsistent. The fix marks translated GSO packets with SKB_GSO_DODGY so segmentation avoids skb_segment_list and falls back to safer skb_segment handling.

Likely exposure

Likely exposure is limited to Linux systems using affected kernel versions and forwarding traffic through IPv4/IPv6 protocol translation paths. General-purpose Linux hosts not performing this forwarding or XLAT behavior appear less likely to be meaningfully exposed based on the supplied description.

Exploitation context

No active exploitation is supported by the provided data. KEV is false, and the cited description frames this as a network forwarding correctness and throughput issue rather than remote code execution, privilege escalation, or data theft.

Researcher notes

Evidence is incomplete for exploitability, severity, and exact version boundaries. The best-supported impact is degraded forwarding behavior caused by unsafe frag_list GSO segmentation after XLAT. Avoid extrapolating beyond Linux kernel forwarding and protocol translation contexts.

Mitigation direction

  • Check Linux distribution and vendor advisories for corrected kernel packages.
  • Prioritize updates on routers, gateways, hotspots, and translation-heavy Linux systems.
  • Review the referenced stable kernel commits for applicable fixed versions.
  • If patching is delayed, monitor affected forwarding paths for throughput degradation.
  • Track Siemens advisories if using Siemens products that embed affected Linux kernels.

Validation and detection

  • Inventory Linux kernel versions on systems performing packet forwarding or XLAT.
  • Confirm whether IPv4/IPv6 protocol translation helpers are used in the traffic path.
  • Verify installed kernel packages include the referenced stable fixes.
  • Test hotspot or IPv6-only upstream forwarding throughput after remediation.
  • Review vendor advisories for product-specific affected version statements.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23154 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux9fd1ff5d2ac7181844735806b0a703c942365291, 9fd1ff5d2ac7181844735806b0a703c942365291, 9fd1ff5d2ac7181844735806b0a703c942365291, 9fd1ff5d2ac7181844735806b0a703c942365291, 9fd1ff5d2ac7181844735806b0a703c942365291unaffected
LinuxLinux5.6, 0, 6.1.167, 6.6.130, 6.12.69, 6.18.9, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.