{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:11",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: gro: fix double aggregation of flush-marked skbs  Commit 0ab03f353d36 (\"net-gro: Fix GRO flush when receiving a GSO packet.\") added a flush check to skb_gro_receive(), but skb_gro_receive_list() lacks the same validation.  As a result, packets marked with NAPI_GRO_CB(skb)-\u003eflush may still be re-aggregated.  This allows already-GRO'd packets with existing frag_list to be re-aggregated into a new GRO session, corrupting the frag_list chain structure. When skb_segment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic.  Scenario (Tethering/Device forwarding):   1. Driver: Generated aggregated packet P1 via LRO with frag_list   2. Dev A: Receives aggregated fraglist packet and flush flag set   3. Dev A: Re-enters GRO, skb_gro_receive_list() is called   4. Missing flush check allows re-aggregation despite flush flag   5. Frag_list chain becomes corrupted (loops or dangling refs)   6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list  Root cause in skb_segment():   The check at line ~4891:     if (hsize \u003c= 0 \u0026\u0026 i \u003e= nfrags \u0026\u0026 skb_headlen(list_skb) \u0026\u0026         (skb_headlen(list_skb) == len || sg)) {    When frag_list is corrupted by double aggregation, when list_skb is   a NULL pointer from skb-\u003enext, skb_headlen(list_skb) dereference   NULL/corrupted pointers occurs.  Call Trace:  skb_headlen(NULL skb)  skb_segment  tcp_gso_segment  tcp4_gso_segment  inet_gso_segment  skb_mac_gso_segment  __skb_gso_segment  skb_gso_segment  validate_xmit_skb  validate_xmit_skb_list  sch_direct_xmit  qdisc_restart  __qdisc_run  qdisc_run  net_tx_action  Fix: Add NAPI_GRO_CB(skb)-\u003eflush validation to the early-return check in skb_gro_receive_list(), matching the defensive programming pattern of skb_gro_receive().",
  "id": "DEBIAN-CVE-2026-68136",
  "modified": "2026-08-18T12:47:36.463837860Z",
  "published": "2026-08-10T13:19:59.120Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68136"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-68136"
  ]
}