CVE-2026-80725: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80725 is an out-of-bounds write vulnerability in the Linux kernel's Generic Receive Offload (GRO) implementation, specifically in the skb_gro_receive() function's BIG TCP aggregation validation logic. The flaw was introduced by commit b1a78b9b9886 ("net: add support for ipv4 big tcp") and affects Linux kernel versions from 5.19 up to (but not including) the patched stable releases: 6.1.185, 6.6.154, 6.12.106, and 6.18.47; the issue does not exist in mainline 7.0+ due to a subsystem rewrite. It was published on August 29, 2026. The CVSS severity is estimated as Medium, with an EPSS score of approximately 0.191% (GitHub Advisory, Kernel CVE Announce).

The root cause is improper input validation (CWE class: out-of-bounds write) in skb_gro_receive() when handling BIG TCP packet aggregation beyond the 64KB GRO_LEGACY_MAX_SIZE limit. Three specific flaws exist: (1) the function incorrectly checks skb_headroom(p) (which includes mac_len) instead of the actual space before the MAC header (p->mac_header), allowing crafted frames injected via AF_PACKET with fewer than 8 bytes of MAC header space to pass validation — when ipv6_gro_complete() subsequently inserts the temporary HBH jumbo header via memmove(), it writes before skb->head, causing an out-of-bounds write; (2) non-IP protocols such as software VLAN (ETH_P_8021Q/ETH_P_8021AD) were incorrectly permitted to aggregate beyond 64KB; and (3) the check used p->encapsulation rather than NAPI_GRO_CB(skb)->encap_mark, allowing encapsulated flows (e.g., SIT/IPv6-in-IPv4 tunnels) to bypass size restrictions. The fix enforces strict criteria: TCP protocol only (NAPI_GRO_CB(skb)->proto == IPPROTO_TCP), no encapsulation, protocol must be ETH_P_IP or ETH_P_IPV6, and for IPv6, p->mac_header must be at least sizeof(struct hop_jumbo_hdr) (GitHub Advisory).

Successful exploitation can allow an unauthenticated remote attacker to trigger a kernel out-of-bounds write by sending specially crafted network packets, potentially leading to arbitrary code execution within the kernel context. A compromised kernel could result in full system takeover, privilege escalation, data exfiltration, or denial of service. The vulnerability is exploitable from the network without authentication, making it particularly dangerous on systems with GRO-enabled interfaces exposed to untrusted traffic (GitHub Advisory, Kernel CVE Announce).

As of the publication date (August 29, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.191% (9th percentile), indicating a low near-term exploitation probability. No threat actor attribution has been reported (GitHub Advisory).

1. Identify a target: Locate a Linux system running kernel versions 5.19 through the unpatched stable branches (pre-6.1.185, pre-6.6.154, pre-6.12.106, or pre-6.18.47) with GRO enabled on a network interface accessible to the attacker.
2. Craft a malicious frame: Using raw socket access (e.g., AF_PACKET), construct a network frame designed to pass the flawed skb_headroom(p) check while having p->mac_header < 8 bytes of actual space before the MAC header.
3. Trigger GRO aggregation: Send the crafted frame to the target system such that the kernel's GRO subsystem attempts to aggregate it as a BIG TCP packet beyond the 64KB limit, invoking skb_gro_receive().
4. Trigger out-of-bounds write: When ipv6_gro_complete() attempts to insert the temporary HBH jumbo header via memmove(), the write begins before skb->head, corrupting kernel memory and wrapping skb->mac_header.
5. Achieve kernel code execution: Leverage the memory corruption to overwrite kernel data structures (e.g., function pointers, security credentials) to escalate privileges or execute arbitrary code in kernel context (GitHub Advisory).

• Network: Unusual raw network frames (via AF_PACKET) with malformed or minimal MAC headers targeting GRO-enabled interfaces; large volumes of oversized (>64KB) aggregated packets from unexpected sources.
• Logs: Kernel oops, BUG, or panic messages in /var/log/kern.log or dmesg referencing skb_gro_receive, ipv6_gro_complete, or memory corruption near skb->head; unexpected memmove out-of-bounds errors in network stack traces.
• Process: Unexpected privilege escalation events or processes running as root without corresponding user-space authentication; anomalous kernel module loading following network activity.
• File System: Unexpected modifications to kernel memory-mapped files or sudden appearance of setuid binaries following network-based activity.

Apply the kernel stable branch patches that fix skb_gro_receive() validation: upgrade to Linux 6.1.185, 6.6.154, 6.12.106, or 6.18.47 (or later). The issue does not affect mainline kernel 7.0+ due to the BIG TCP subsystem rewrite in commit 81be30c1f5f2. As a temporary workaround where patching is not immediately possible, disable GRO on untrusted network interfaces using ethtool -K <interface> gro off. Restricting AF_PACKET socket access to privileged users can also reduce the attack surface (GitHub Advisory, Kernel Stable Patch).

The vulnerability was announced via the official Linux kernel CVE mailing list and picked up by standard vulnerability tracking services including VulDB, OSV, INCIBE-CERT, and Tenable Nessus (detection IDs 341561 and 341563). Social media activity was limited to automated CVE tracking accounts on Bluesky and Mastodon/infosec.exchange. No notable independent researcher commentary or significant media coverage has been identified beyond routine vulnerability database entries (Kernel CVE Announce, Tenable Nessus).