In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/3556beb8ca86677af2aca5bfbed6f8e790fccc83 cve-icon cve-icon
https://git.kernel.org/stable/c/36e0741833bd823866f8cb9f112f37cea1a70b60 cve-icon cve-icon
https://git.kernel.org/stable/c/515b6816ba0c12d8415c88e5f41e6ec029e35cfa cve-icon cve-icon
https://git.kernel.org/stable/c/74ce7389f8f562d39015f59a00ef7ad6acd37803 cve-icon cve-icon
https://git.kernel.org/stable/c/a716a64a4ba68cd46f2745fba2b1099fe8e0aa59 cve-icon cve-icon
https://git.kernel.org/stable/c/b0ea911453ce7210e8200a07a94d2458bd1e6430 cve-icon cve-icon
https://git.kernel.org/stable/c/c0726f0caf8c6b3208552949e17d23634a2f3129 cve-icon cve-icon
https://git.kernel.org/stable/c/c8a74adccaf028223054633b532593101dfcc581 cve-icon cve-icon
https://git.kernel.org/stable/c/d9d1a676b033acabf8e5645f730486d1f8204a3f cve-icon cve-icon
History

Fri, 04 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-674

Fri, 04 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.
Title ipv4: reject undersized MTUs in ip_do_fragment()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:13:05.814Z

Updated: 2026-09-04T15:13:05.814Z

Reserved: 2026-08-26T14:34:25.793Z

Link: CVE-2026-80793

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T16:18:05.613

Modified: 2026-09-04T16:18:05.613

Link: CVE-2026-80793

cve-icon Redhat

No data.