CVE-2026-80793
ipv4: reject undersized MTUs in ip_do_fragment()
Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check.
INFO
Published Date :
Sept. 4, 2026, 4:18 p.m.
Last Modified :
Sept. 4, 2026, 4:18 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the patch to ip_do_fragment.
- Reject mtu < hlen + 8.
- Match the existing IPv6 fragmentation check.
- Update the Linux kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-80793.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-80793 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-80793
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-80793 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-80793 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 04, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in ip_do_fragment() ip_do_fragment() subtracts the IPv4 header length from the effective MTU and passes the resulting payload MTU to ip_frag_next(). If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds the fragment payload length down to zero. The fragmentation state then never makes forward progress: state->left, state->ptr and state->offset stay unchanged while ip_do_fragment() keeps allocating and transmitting header-only fragments until the softlockup detector fires. This is reproducible with a route installed using "mtu lock 20", but it is also reproducible without route MTU lock, for example by forwarding a packet to a device whose MTU is 20. Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE, matching the existing IPv6 fragmentation check. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/80xxx/CVE-2026-80793.json">CVE-2026-80793</a> Added Reference https://git.kernel.org/stable/c/3556beb8ca86677af2aca5bfbed6f8e790fccc83 Added Reference https://git.kernel.org/stable/c/36e0741833bd823866f8cb9f112f37cea1a70b60 Added Reference https://git.kernel.org/stable/c/515b6816ba0c12d8415c88e5f41e6ec029e35cfa Added Reference https://git.kernel.org/stable/c/74ce7389f8f562d39015f59a00ef7ad6acd37803 Added Reference https://git.kernel.org/stable/c/a716a64a4ba68cd46f2745fba2b1099fe8e0aa59 Added Reference https://git.kernel.org/stable/c/b0ea911453ce7210e8200a07a94d2458bd1e6430 Added Reference https://git.kernel.org/stable/c/c0726f0caf8c6b3208552949e17d23634a2f3129 Added Reference https://git.kernel.org/stable/c/c8a74adccaf028223054633b532593101dfcc581 Added Reference https://git.kernel.org/stable/c/d9d1a676b033acabf8e5645f730486d1f8204a3f