# CVE-2026-53091

## Summary

- **CVE ID:** CVE-2026-53091
- **Severity:** HIGH
- **CVSS Score:** 8.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H)
- **CWE:** N/A
- **Published:** Jun 24, 2026
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

net: pull headers in qdisc_pkt_len_segs_init()

Most ndo_start_xmit() methods expects headers of gso packets
to be already in skb->head.

net/core/tso.c users are particularly at risk, because tso_build_hdr()
does a memcpy(hdr, skb->data, hdr_len);

qdisc_pkt_len_segs_init() already does a dissection of gso packets.

Use pskb_may_pull() instead of skb_header_pointer() to make
sure drivers do not have to reimplement this.

Some malicious packets could be fed, detect them so that we can
drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.

## Affected Products

- Linux — Linux (e876f208af18b074f800656e4d1b99da75b2135f)
- Linux — Linux (3.16)
- Linux — Linux (0)
- Linux — Linux (7.0.10)
- Linux — Linux (7.1)

## References

- [CNA](https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a)
- [CNA](https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-53091)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2492270)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:65334)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:66325)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:66324)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:67150)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.14%
- **EPSS Percentile:** 3.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._