CVE-2026-53091 — Kernel
HIGHCVE-2026-53091 is a high-severity (CVSS 8.4) CWE-131 vulnerability in Kernel. A fix is available for Kernel — see the affected versions and patch details below.
net: pull headers in qdisc_pkt_len_segs_init()
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-53091 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,386 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
KernelReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Linux packages — download data is not available via public APIs for these ecosystems.
Description
In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdisc_pkt_len_segs_init()
Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.
net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len);
qdisc_pkt_len_segs_init() already does a dissection of gso packets.
Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐧Linux | Kernel | ≥ 3.16.0&&< 7.0.10 | 7.0.10 |
Affected Products
linux kernellinuxDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Kernel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update Kernel to 7.0.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-53091 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 10 | kernel-0:6.12.0-211.53.1.el10_2 | RHSA-2026:65334 |
| Red Hat Enterprise Linux 8 | kernel-rt-0:4.18.0-553.162.1.rt7.503.el8_10 | RHSA-2026:66324 |
| Red Hat Enterprise Linux 8 | kernel-0:4.18.0-553.162.1.el8_10 | RHSA-2026:66325 |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-687.47.1.el9_8 | RHSA-2026:67150 |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | kernel-0:5.14.0-427.153.1.el9_4 | RHSA-2026:73645 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | kernel-0:5.14.0-570.146.1.el9_6 | RHSA-2026:74174 |
Frequently Asked Questions
Is CVE-2026-53091 in your dependencies?
Find it across Linux, including transitive dependencies.