Answer in brief
CVE-2026-72502 records a Unknown severity vulnerability in tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-72502 records a Unknown severity vulnerability in tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <560b33b434e922ef97f9ff23aa2e909ef7aacd5c || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <21f69ac1879bb970588d5e7c12a96e6542f7c1a7 || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <c0db3dc2ac323b6c4b76adede3b355a9daa6dea8 || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <572fff10819dfc359298d1f774839e76a4d96f93 || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <8e6214a530c03e341dc1b0a846c8f2b716b3551a || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <a210791f33345aa87187f7d7a9f3b9b7f4a28e6d || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22 | 560b33b434e922ef97f9ff23aa2e909ef7aacd5c, 21f69ac1879bb970588d5e7c12a96e6542f7c1a7, c0db3dc2ac323b6c4b76adede3b355a9daa6dea8, 572fff10819dfc359298d1f774839e76a4d96f93, 8e6214a530c03e341dc1b0a846c8f2b716b3551a, d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e, a210791f33345aa87187f7d7a9f3b9b7f4a28e6d, 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22 |
| Linux/Linuxgeneric | 4.8 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference because local TCP packets do not use frag_list. Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large. Also update the stale comment in ip6_default_advmss() which suggested that IPV6_MAXPLEN is returned to mean "any MSS".
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <560b33b434e922ef97f9ff23aa2e909ef7aacd5c || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <21f69ac1879bb970588d5e7c12a96e6542f7c1a7 || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <c0db3dc2ac323b6c4b76adede3b355a9daa6dea8 || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <572fff10819dfc359298d1f774839e76a4d96f93 || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <8e6214a530c03e341dc1b0a846c8f2b716b3551a || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <a210791f33345aa87187f7d7a9f3b9b7f4a28e6d || >=3953c46c3ac7eef31a9935427371c6f54a22f1ba <2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22 | 560b33b434e922ef97f9ff23aa2e909ef7aacd5c, 21f69ac1879bb970588d5e7c12a96e6542f7c1a7, c0db3dc2ac323b6c4b76adede3b355a9daa6dea8, 572fff10819dfc359298d1f774839e76a4d96f93, 8e6214a530c03e341dc1b0a846c8f2b716b3551a, d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e, a210791f33345aa87187f7d7a9f3b9b7f4a28e6d, 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22 |
| Linux/Linuxgeneric | 4.8 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference because local TCP packets do not use frag_list. Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large. Also update the stale comment in ip6_default_advmss() which suggested that IPV6_MAXPLEN is returned to mean "any MSS".
Quoted source text, attributed separately from HOL analysis.