CVE-2026-23154: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23154 is a GSO (Generic Segmentation Offload) segmentation flaw in the Linux kernel's network stack affecting forwarding of fraglist GRO packets during IPv4/IPv6 protocol translation (XLAT). The vulnerability was published on February 14, 2026, and affects Linux kernel versions 5.6 through 6.12.68, 6.13 through 6.18.8, and 6.19-rc1 through rc7. It carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector requiring low privileges (Feedly).

The root cause is improper handling of the SKB_GSO_DODGY flag during GSO segmentation of GRO packets forwarded through XLAT protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). When XLAT translates only the header of the head skb, fragments in the frag_list may remain untranslated; the function skb_segment_list then incorrectly processes these partially translated GRO skbs, resulting in protocol inconsistencies (CWE classification aligns with improper input validation in network buffer handling). The fix explicitly sets SKB_GSO_DODGY after protocol translation, causing the kernel to fall back to the safer skb_segment path instead of skb_segment_list for such packets (Feedly, Kernel Patch 1).

Exploitation of this vulnerability results in network throughput degradation and protocol inconsistencies when a Linux system acts as a gateway or hotspot performing IPv4/IPv6 XLAT translation — for example, when a station accesses IPv4 servers via a hotspot with an IPv6-only upstream interface. A local attacker with low privileges can trigger packet processing errors that cause denial of service through reduced network performance or service disruption. There is no confidentiality or integrity impact; the effect is limited to availability of network services on the affected system (Feedly).

Upgrade the Linux kernel to version 6.12.69 or later (for the 6.12 stable branch) or 6.18.9 or later (for the 6.18 stable branch) to remediate this vulnerability. Patch commits are available at git.kernel.org (commit IDs: 3d48d59235c494d34e32052f768393111c0806ef, 3e62db1e3140449608975e29e0979cc5f3b1cc07, and 426ca15c7f6cb6562a081341ca88893a50c59fa2). Downstream distributions including Oracle Linux, SUSE, Debian, and Amazon Linux 2023 have issued updated kernel packages. Systems not acting as IPv4/IPv6 XLAT gateways or hotspots face significantly reduced risk (Feedly, Kernel Patch 1).