{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0fe79f28bfaf73b66b7b1562d2468f94aa03bd12"
            },
            {
              "fixed": "37a5dcd6837fc2afc44a7bc3ed8af4e983783d46"
            },
            {
              "fixed": "e907bf694ed55bdfe421be99dba35751a655df25"
            },
            {
              "fixed": "03cb8cc2961f5f781d12e903782cb3815ed84b1c"
            },
            {
              "fixed": "3ce832e2bd431d0c12ba525ed73ad8fbc4191da5"
            },
            {
              "fixed": "81be30c1f5f2bffda1f04c0efd0746af10b9643a"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.19.0"
            },
            {
              "fixed": "6.1.185"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.154"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.106"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.47"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80725.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 (\"net: add support for ipv4 big tcp\")\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n   before the MAC header (p-\u003emac_header). Because skb_headroom(p) includes\n   mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n   with p-\u003emac_header \u003c 8 bytes. When ipv6_gro_complete() inserts the\n   temporary HBH jumbo header, the memmove() starts before skb-\u003ehead,\n   causing an out-of-bounds write and wrapping skb-\u003emac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n   ETH_P_8021AD) to aggregate beyond 64KB because\n   p-\u003eprotocol != ETH_P_IPV6 was true.\n3. It checked p-\u003eencapsulation instead of NAPI_GRO_CB(skb)-\u003eencap_mark,\n   allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n   beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)-\u003eproto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)-\u003eencap_mark \u0026\u0026 !p-\u003eencapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p-\u003emac_header must be at least\n  sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at \u003c= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 (\"net/ipv6: Drop HBH for BIG TCP on RX\nside\"), making this fix relevant only for older stable branches like\n6.18.y.",
  "id": "CVE-2026-80725",
  "modified": "2026-09-05T03:30:30.182776903Z",
  "published": "2026-08-29T06:39:35.212Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/03cb8cc2961f5f781d12e903782cb3815ed84b1c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/37a5dcd6837fc2afc44a7bc3ed8af4e983783d46"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3ce832e2bd431d0c12ba525ed73ad8fbc4191da5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/81be30c1f5f2bffda1f04c0efd0746af10b9643a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e907bf694ed55bdfe421be99dba35751a655df25"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80725.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80725"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "net: gro: properly validate BIG TCP aggregation criteria"
}