Preface: Modern high-performance network stacks, particularly those in Linux-based CDN edge routing fabrics, utilize Generic Receive Offload (GRO) for GRE traffic. In fact, GRO is essential for handling GRE-encapsulated DDoS or DSR traffic at line-rate speeds (such as 10Gbps, 40Gbps, or 100Gbps) without completely exhausting the host’s CPU.

Background: Without GRO, a Linux server handling high-throughput VXLAN or VLAN traffic would experience severe CPU bottlenecks.

• The Problem: Modern network interface cards (NICs) can pump 40Gbps, 100Gbps, or more into a server. Processing every single standard 1500-byte packet individually creates a massive CPU overhead due to per-packet kernel interrupts.
• The GRO Solution: GRO acts as a software-based aggregator right above the network driver. It intercepts incoming packets and merges them into fewer, much larger packets (up to 64KB, or larger with BIG TCP) before passing them up the networking stack. This drastically reduces the CPU cycles required for packet processing.

For our edge architecture, the issue is that we rely heavily on GRO to aggregate packets at the ingress line-rate to conserve CPU cycles. Because skb_headroom miscalculates buffer boundaries over nested VLAN tags, any crafted frame entering via a trunk line forces ipv6_gro_complete to start its memmove() operations before the actual allocated boundary of skb->head. It completely bypasses our typical 64KB limits.

From a security standpoint, the exploitability window here doesn’t require authenticated access. Because this logic flaw processes traffic right as it hits the Linux network stack, a remote attacker targeting our IPv6 endpoints can force a host-level kernel panic. In a multi-tenant CDN environment, a single poisoned stream can knock out an entire edge node’s packet-forwarding engine, creating a direct operational availability risk.

Vulnerability details: When the kernel fails to strictly limit BIG TCP aggregation to plain, non-encapsulated IPv4/IPv6 TCP packets with adequate hardware headroom, the function skb_gro_receive() checked skb_headroom(p) rather than the definitive space directly before the MAC header (p->mac_header). Because headroom includes the MAC length, a specifically crafted frame (such as one injected via AF_PACKET) could trick the kernel into proceeding even if the MAC header room was smaller than 8 bytes. When ipv6_gro_complete() subsequently tried to insert the temporary Hop-by-Hop (HBH) jumbo header via memmove(), the write operation occurred outside the allocated buffer space (skb->head), corrupting memory and wrapping the skb->mac_header pointer.

The primary technical problem stems from a loosened validation check in the Linux kernel’s GRO (Generic Receive Offload) subsystem specifically tracked as CVE-2026-80725, which permitted unauthorized protocols to bypass the maximum 64KB legacy packet size limit (GRO_LEGACY_MAX_SIZE), resulting in memory corruption and kernel stability failures.

Official announcement: For details please refer to link – https://www.tenable.com/cve/CVE-2026-80725