DEBIAN-CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved:  net: gro: fix double aggregation of flush-marked skbs  Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skbgroreceive(), but skbgroreceivelist() lacks the same validation.  As a result, packets marked with NAPIGROCB(skb)->flush may still be re-aggregated.  This allows already-GRO'd packets with existing fraglist to be re-aggregated into a new GRO session, corrupting the fraglist chain structure. When skbsegment() attempts to unpack these malformed packets, it encounters invalid state and triggers a kernel panic.  Scenario (Tethering/Device forwarding):   1. Driver: Generated aggregated packet P1 via LRO with fraglist   2. Dev A: Receives aggregated fraglist packet and flush flag set   3. Dev A: Re-enters GRO, skbgroreceivelist() is called   4. Missing flush check allows re-aggregation despite flush flag   5. Fraglist chain becomes corrupted (loops or dangling refs)   6. Dev B: TX path calls skbsegment(), crashes on corrupted fraglist  Root cause in skbsegment():   The check at line ~4891:     if (hsize <= 0 && i >= nfrags && skbheadlen(listskb) &&         (skbheadlen(listskb) == len || sg)) {    When fraglist is corrupted by double aggregation, when listskb is   a NULL pointer from skb->next, skbheadlen(listskb) dereference   NULL/corrupted pointers occurs.  Call Trace:  skbheadlen(NULL skb)  skbsegment  tcpgsosegment  tcp4gsosegment  inetgsosegment  skbmacgsosegment  skbgsosegment  skbgsosegment  validatexmitskb  validatexmitskblist  schdirectxmit  qdiscrestart  qdiscrun  qdiscrun  nettxaction  Fix: Add NAPIGROCB(skb)->flush validation to the early-return check in skbgroreceivelist(), matching the defensive programming pattern of skbgroreceive().