CVE-2026-46273: ibmveth: Disable GSO for packets with small MSS
In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adapters on Power systems do not support segmentation offload when the MSS is less than 224 bytes. Attempting to send such packets causes the adapter to freeze, stopping all traffic until manually reset. Implement ndo_features_check to disable GSO for packets with small MSS values. The network stack will perform software segmentation instead. The 224-byte minimum matches ibmvnic commit <f10b09ef687f> ("ibmvnic: Enforce stronger sanity checks on GSO packets") which uses the same physical adapters in SEA configurations. The issue occurs specifically when the hardware attempts to perform segmentation (gso_segs > 1) with a small MSS. Single-segment GSO packets (gso_segs == 1) do not trigger the problematic LSO code path and are transmitted normally without segmentation. Add an ndo_features_check callback to disable GSO when MSS < 224 bytes. Also call vlan_features_check() to ensure proper handling of VLAN packets, particularly QinQ (802.1ad) configurations where the hardware parser may not support certain offload features. Validated using iptables to force small MSS values. Without the fix, the adapter freezes. With the fix, packets are segmented in software and transmission succeeds. Comprehensive regression testing completedd (MSS tests, performance, stability).
Metrics
- CVSS v3.1
- 8.6
- Severity
- HIGH
- Fixed in
- 0
- Affected Products
- 2
HarborGuard Analysis
Synopsis
A denial-of-service vulnerability exists in the Linux kernel's ibmveth network driver, which handles virtual Ethernet on IBM Power systems. An unauthenticated remote attacker can send specially crafted TCP packets with a small Maximum Segment Size (MSS, below 224 bytes) that cause the physical adapter to freeze, halting all network traffic through the affected interface until a manual reset is performed. No code execution or data access is possible; the impact is complete loss of network availability on the affected host. A patched-image rebuild is available on HarborGuard for environments running affected kernel versions.
HarborGuard Coverage
Detection of CVE-2026-46273 is available across every HarborGuard environment; the CVE is ingested from upstream feeds within minutes of publication and matched against all customer images, including custom-built images that bundle an affected Linux kernel version. Images in both registry scans and active CI/CD pipeline runs are covered.
AvailableHarborGuard surfaces this CVE with its CVSS v3.1 score of 8.6 (HIGH) and weights it against each environment's compliance policy to determine urgency and routing. Triage tickets are routed to the appropriate team inbox within each customer organization based on configured ownership rules.
AvailableA patched-image rebuild at the fix versions (5.10.258, 5.15.209, or the corresponding upstream commits) becomes available on HarborGuard for any image found to carry an affected kernel. For customers who opt into auto-remediation, HarborGuard triggers a rebuild, runs a regression test suite, and opens a pull request against affected workloads automatically.
AvailableExploit Conditions
- Network reachabilityRequired
The attacker sends packets over the network to a host using the ibmveth adapter; the vulnerable code path is reached remotely without any prior foothold on the target.
- AuthenticationNot required
No account or credentials are needed; any host that can route TCP traffic to the target can trigger the adapter freeze.
- Victim interactionNot required
No user on the target system needs to take any action; receiving the crafted packets is sufficient to trigger the freeze.
- Attack complexityDetail
Exploitation is straightforward and condition-free; the attacker simply sends packets with an MSS below 224 bytes, which the hardware processes reliably in the vulnerable way.
Blast Radius
- The physical network adapter on the affected IBM Power host freezes, stopping all inbound and outbound traffic on that interface until an operator manually resets it.
- Any workloads or services depending on the frozen interface lose network connectivity for the duration of the outage.
- No confidential data is read and no stored data is modified; the impact is limited entirely to availability.
How HarborGuard Handles This
Available on HarborGuard: images containing an affected ibmveth kernel version are flagged automatically within minutes of CVE ingestion, covering both registry-resident images and images built inside customer CI pipelines. The CVSS 8.6 HIGH severity rating is applied immediately, and compliance-policy weighting routes the finding to the correct team. For customers who opt into auto-remediation, HarborGuard rebuilds the image at a fixed kernel version (5.10.258, 5.15.209, or the patched upstream commit), runs a regression pass, and opens a pull request against affected workloads; median time from CVE publication to merged patch PR for high-severity issues is around 90 minutes for environments with auto-remediation enabled. For environments where auto-remediation is not permitted by compliance policy, HarborGuard surfaces the finding for manual review and provides the fix-version targets needed to plan the upgrade. As a compensating control while a rebuild is being prepared, network policy rules that limit external TCP connections to the affected host can reduce the window of exposure by restricting which sources can send packets with arbitrary MSS values.
Fix available
- Linux / Linux< 86fc64584811d43c9ccd74447de58620189d8b77 (from 8641dd85799f85bef5f0d1f87356aaa12cb2195e) · < 9a5e984d7af910e46dcbed3ce77873e000a4f77d (from 8641dd85799f85bef5f0d1f87356aaa12cb2195e) · < 1cdf5dbcec988d06f5f720bdf89e91073f77fa10 (from 8641dd85799f85bef5f0d1f87356aaa12cb2195e) · < 82bc89fbb82d9396fb4eaee8720ea85e2e787957 (from 8641dd85799f85bef5f0d1f87356aaa12cb2195e) · < db8012c631cb845e9ae2b4b531e17d86c9519755 (from 8641dd85799f85bef5f0d1f87356aaa12cb2195e) · < c1f261863e65b508f37416dfbc5c5d911c9b9233 (from 8641dd85799f85bef5f0d1f87356aaa12cb2195e)
- Linux / Linux4.2Fixed in 0, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7, 7.1-rc2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H