CVE-2026-22979: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22979 is a memory leak vulnerability in the Linux kernel's skb_segment_list() function affecting GRO (Generic Receive Offload) packet forwarding. The flaw causes incorrect socket memory accounting, preventing proper socket destruction and leading to persistent kernel memory leaks. It was published on January 23, 2026, and affects multiple Linux kernel stable branches including 5.15.154–5.16, 6.1.85–6.1.160, 6.6.26–6.6.120, 6.8.5–6.9, 6.9.1–6.12.65, and 6.13–6.18.5. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (RedHat CVE, Feedly).

The root cause (CWE-401: Missing Release of Memory after Effective Lifetime) lies in a regression introduced after commit ed4cccef64c1 ("gro: fix ownership transfer"), which orphaned fraglist entries (skb->sk = NULL) to prevent illegal orphaning downstream. However, the corresponding accounting logic in skb_segment_list() was never updated: the function still unconditionally adds each fragment's truesize to delta_truesize and subtracts it from the parent SKB, even though fragments are no longer charged to the socket. This under-count causes sk_wmem_alloc to remain non-zero after the head SKB is freed, blocking socket destruction. The bug is locally exploitable (AV:L) by a low-privileged user (PR:L) and requires no user interaction. The leak is observable via KMEMLEAK, which reports unreferenced socket objects allocated during network operations such as ping (Feedly).

Successful triggering of this vulnerability results in a persistent kernel memory leak that accumulates over time, ultimately exhausting kernel memory and causing denial of service conditions. There is no confidentiality or integrity impact — the vulnerability is limited to availability (A:H). Systems with high packet forwarding rates, GRO-enabled network interfaces, or heavy fragmented packet workloads are most severely affected, as the leak rate scales with traffic volume (Feedly).

• Logs: KMEMLEAK reports of unreferenced kernel objects with backtraces referencing kmem_cache_alloc_noprof, sk_prot_alloc, sk_alloc, inet6_create, __sock_create, or __sys_socket; example: unreferenced object 0xffff8881e6eb9100 (size 2048): comm "ping", pid <N>.
• System Behavior: Gradual increase in kernel memory consumption on systems performing packet forwarding with GRO-enabled interfaces; sockets failing to be destroyed after network teardown.
• Monitoring: Non-zero sk_wmem_alloc values persisting after socket close operations; elevated /proc/net/sockstat memory counters that do not decrease over time.

The primary remediation is to upgrade to a patched kernel version: 5.16+, 6.1.161+, 6.6.121+, 6.9+ (for 6.8.5+ branch), 6.12.66+, or 6.18.6+, depending on the currently deployed branch. Five upstream stable commits address the issue: 0b27828ebd1e, 238e03d04662, 3264881431e3, 88bea149db20, and c114a32a2e70. As a temporary workaround where patching is not immediately possible, GRO can be disabled on affected interfaces using ethtool -K <interface> gro off, though this may reduce network throughput. Administrators should monitor kernel memory usage and socket lingering as indicators of the issue (Feedly, RedHat CVE).

Red Hat tracked this vulnerability and assigned a CVSS score via their advisory pipeline. Ubuntu issued multiple security notices addressing this CVE (USN-8278-1, USN-8278-2, USN-8289-1, USN-8289-2, USN-8296-1, USN-8296-2, USN-8393-1), and SUSE released a corresponding kernel update (SUSE-2026-0962-1). Oracle also issued an enterprise kernel advisory (oracle-el-2026-50144). The Yocto Project security mailing list discussed the issue across multiple threads. No notable independent researcher commentary or significant social media discussion beyond automated CVE tracking feeds has been observed.