CVE-2026-72502 Linux CVE debrief

Who should care

Linux kernel users and administrators, network administrators, and security teams should be aware of this vulnerability and its potential impact on their systems. They should review their system's configurations and ensure that they are not exposed to this vulnerability. Additionally, they should monitor network traffic for suspicious activity and review system logs for potential exploitation attempts. Affected operator, platform, vulnerability-management, and security-team impact should be carefully evaluated to ensure that all necessary precautions are taken. This includes verifying that vendor patches or updates are applied, and that compensating controls such as firewall rules or intrusion detection systems are in place. Linux kernel users and administrators should also consider implementing additional security measures, such as access controls and incident response plans, to mitigate the potential impact of this vulnerability. Furthermore, they should stay informed about the latest developments and updates regarding this vulnerability and its potential impact on their systems. They should also review and update their incident response plans to ensure that they are prepared to respond to potential exploitation attempts. The affected scope and vendor remediation strategies should be carefully evaluated to ensure that all necessary precautions are taken. This includes verifying that all necessary patches or updates are applied, and that all affected systems are properly configured and secured. Linux kernel users and administrators should also consider conducting regular security audits and risk assessments to identify potential vulnerabilities and implement necessary controls. By taking these precautions, Linux kernel users and administrators can help mitigate the potential impact of this vulnerability and ensure the security and integrity of their systems. Linux kernel users and administrators should also consider implementing additional security measures, such as network segmentation and isolation, to prevent the spread of potential exploitation attempts. They should also review and update their security policies and procedures to ensure that they are aware

Technical summary

The Linux kernel has a vulnerability where a large MTU can cause ip6_default_advmss() to return IPV6_MAXPLEN (65535), which is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference. The fix returns min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel versions for potential vulnerability
• Apply vendor patches or updates to address the vulnerability
• Monitor network traffic for suspicious activity
• Consider implementing compensating controls, such as firewall rules or intrusion detection systems
• Review system logs for potential exploitation attempts
• Verify that vendor patches or updates are applied and that compensating controls are in place
• Conduct regular security audits and risk assessments to identify potential vulnerabilities

Evidence notes

The CVE record and NVD entry provide information about the vulnerability and its fix. However, there is limited information about the affected scope and vendor remediation. Linux kernel users and administrators should verify their systems for potential exposure and review vendor guidance for patching or mitigation strategies. The vulnerability affects the Linux kernel's handling of TCP packets with large MTUs, which can cause ip6_default_advmss() to return IPV6_MAXPLEN (65535). This value is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference. The fix returns min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large. Additional verification tasks include reviewing system logs for suspicious activity and ensuring that network traffic is monitored for potential exploitation attempts.

Official resources