CVE-2026-68136

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix double aggregation of flush-marked skbs

Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO

packet.") added a flush check to skb_gro_receive(), but

skb_gro_receive_list() lacks the same validation.

As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be

re-aggregated.

This allows already-GRO'd packets with existing frag_list to be

re-aggregated into a new GRO session, corrupting the frag_list chain

structure. When skb_segment() attempts to unpack these malformed packets,

it encounters invalid state and triggers a kernel panic.

Scenario (Tethering/Device forwarding):

1. Driver: Generated aggregated packet P1 via LRO with frag_list

2. Dev A: Receives aggregated fraglist packet and flush flag set

3. Dev A: Re-enters GRO, skb_gro_receive_list() is called

4. Missing flush check allows re-aggregation despite flush flag

5. Frag_list chain becomes corrupted (loops or dan

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References