CVE-2026-90063

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: Ensure that TCP packets don't overflow gso_segs

The user can specify any gso_size in a packet crafted with an AF_PACKET

PACKET_VNET_HDR socket, even smaller than TCP_MIN_GSO_SIZE = 8. At the

same time, GSO_MAX_SIZE = 8 * GSO_MAX_SEGS = 8 * 65535. When the user

crafts a packet with gso_size < 8, there is a risk for partial GSO to

overflow the 16-bit gso_segs field when dividing the SKB length by

gso_size.

Adjust gso_size of TCP packets to be at least TCP_MIN_GSO_SIZE = 8. Keep

gso_size of UDP GSO packets, as gso_size=1 is valid and explicitly

tested at tools/testing/selftests/net/tun.c:649.