CVE-2026-22979

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: fix memory leak in skb_segment_list for GRO packets

When skb_segment_list() is called during packet forwarding, it handles

packets that were aggregated by the GRO engine.

Historically, the segmentation logic in skb_segment_list assumes that

individual segments are split from a parent SKB and may need to carry

their own socket memory accounting. Accordingly, the code transfers

truesize from the parent to the newly created segments.

Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this

truesize subtraction in skb_segment_list() was valid because fragments

still carry a reference to the original socket.

However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed

this behavior by ensuring that fraglist entries are explicitly

orphaned (skb->sk = NULL) to prevent illegal orphaning later in the

stack. This change meant that the entire socket memory charge remained

with the head SKB, but the cor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References