Linux kernel panics on GSO fragments after IP reassembly

The Linux kernel can panic when IPv4 or IPv6 fragments that carry Generic Segmentation Offload (GSO) metadata are reassembled and later handed to software segmentation.

CVE-2026-80590 covers the flaw: a virtio_net_hdr from tun/tap or AF_PACKET can mark a fragment as GSO even though that state has no relationship to fragmentation. Reassembly keeps the first fragment as the head of the rebuilt datagram, so the result still claims to be GSO. The next segmentation point then walks the frag_list under assumptions meant for GRO-shaped input and hits a BUG_ON inside skb_segment. Because the path often runs with bottom halves disabled, the result is a panic rather than a recoverable oops.

An unprivileged user in their own user namespace can trigger it with two writes to a tap device. The same crash is reachable with CAP_NET_RAW where defragmentation precedes a GSO point, and from a guest whose VMM forwards virtio_net_hdr onto a host tap.

Greg Kroah-Hartman announced the fix: GSO state is stripped from fragments before reassembly so the rebuilt packet no longer pretends to be GSO.