CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix double aggregation of flush-marked skbs

Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO

packet.") added a flush check to skbgroreceive(), but

skbgroreceive_list() lacks the same validation.

As a result, packets marked with NAPIGROCB(skb)->flush may still be

re-aggregated.

This allows already-GRO'd packets with existing frag_list to be

re-aggregated into a new GRO session, corrupting the frag_list chain

structure. When skb_segment() attempts to unpack these malformed packets,

it encounters invalid state and triggers a kernel panic.

Scenario (Tethering/Device forwarding):

1. Driver: Generated aggregated packet P1 via LRO with frag_list
2. Dev A: Receives aggregated fraglist packet and flush flag set
3. Dev A: Re-enters GRO, skbgroreceive_list() is called
4. Missing flush check allows re-aggregation despite flush flag
5. Frag_list chain becomes corrupted (loops or dangling refs)
6. Dev B: TX path calls skbsegment(), crashes on corrupted fraglist

Root cause in skb_segment():

  The check at line ~4891:

    if (hsize <= 0 && i >= nfrags && skbheadlen(listskb) &&

        (skbheadlen(listskb) == len || sg)) {

  When fraglist is corrupted by double aggregation, when listskb is

  a NULL pointer from skb->next, skbheadlen(listskb) dereference

  NULL/corrupted pointers occurs.

Call Trace:

 skb_headlen(NULL skb)

 skb_segment

 tcpgsosegment

 tcp4gsosegment

 inetgsosegment

 skbmacgso_segment

 _skbgso_segment

 skbgsosegment

 validatexmitskb

 validatexmitskb_list

 schdirectxmit

 qdisc_restart

 _qdiscrun

 qdisc_run

 nettxaction

Fix: Add NAPIGROCB(skb)->flush validation to the early-return check in

skbgroreceive_list(), matching the defensive programming pattern of

skbgroreceive().