CVE Alert: CVE-2026-100236 – Red Hat

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.

**Risk verdict:** Prioritise systems processing untrusted traffic through software GSO, but exploitation status cannot be established from the supplied data.

**Why this matters:** A successful trigger could disrupt packet processing or the host datapath, affecting service availability; limited data exposure or modification is also possible. Likely attacker goals include interrupting network services or destabilising infrastructure, rather than crossing into a separate security scope.

**Most likely attack path:** A remote sender—or a guest able to supply traffic—needs only to reach a packet-processing path where software GSO is enabled; the network path is exposed, with low complexity and no stated privilege or user-action requirement. Scope is unchanged, so impact is expected within the vulnerable component’s security authority, though disruption could affect dependent workloads.

**Who is most exposed:** Prioritise virtual switching, accelerated networking, cloud and container platforms, and hosts using DPDK-based datapaths that process untrusted or guest-originated packets.

Alert on unexpected datapath or switching-process crashes, restarts, and core dumps.

Review GSO enablement and identify interfaces handling guest or external traffic.

Look for malformed, unusually long or heavily encapsulated packet headers near service disruptions.

Mitigation and prioritisation

Check the vendor advisory for fixed packages and deploy the applicable update promptly; fix availability is not stated here.

Until updated, disable software GSO on paths processing untrusted packets.

Increasing the direct-pool size may help with long headers but does not address all over-read risk.

Test throughput and failover impacts, then schedule controlled datapath changes.

KEV, SSVC, PoC and EPSS data were not supplied; verify these before refining urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.