External risk intelligence

Linux Kernel GRO BIG TCP Packet Aggregation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80725

This vulnerability resides within the Linux kernel network stack's Generic Receive Offload (GRO) processing logic for packet aggregation. It requires specific, crafted network traffic to trigger and is not a service, application, or interface exposed to the internet. It is a low-level internal kernel mechanism that does not constitute a public-facing attack surface.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This issue involves how the Linux kernel processes large network packets, specifically when aggregating them for efficiency. A flaw in this process could allow specially crafted network traffic to bypass security checks, potentially leading to system instability or unauthorized memory access. This impacts older versions of the Linux kernel and may not be relevant for current mainline systems.

Network packet processing flaw.
Affects older Linux kernel versions.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can send specially crafted network packets to a Linux system. The system's network stack, specifically the packet aggregation feature, misinterprets these packets due to an incorrect validation check. This can cause the kernel to write data outside of its intended memory area, potentially leading to system compromise.

Unauthenticated network access required.
Malformed packets trigger flawed aggregation logic.
Out-of-bounds write leads to system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system data by allowing crafted network packets to overwrite critical kernel memory when the Linux kernel's network stack attempts to aggregate packets beyond a certain size. This could lead to unexpected service behavior or system instability under specific conditions involving malformed IPv4 or IPv6 TCP packets, or encapsulated traffic.

Kernel memory.
Crafted network packets.
System instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's network stack (NET: GRO) could be actively exploited. Ownership typically falls to the infrastructure or platform teams managing the Linux systems, with the network security team responsible for assessing external exposure and potentially implementing network-level controls. The first practical step is to identify all Linux systems running affected kernel versions, determine if they are exposed to untrusted network input, and confirm their business criticality to prioritize remediation efforts.

Infrastructure/Platform teams own remediation.
Verify system exposure to untrusted network.
Plan maintenance for kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel GRO feature affected by CVE-2026-80725?

Generic Receive Offload (GRO) is a performance feature in the Linux kernel that combines multiple small incoming network packets into larger ones before they reach the higher-level networking stack. This reduces the processing overhead on the CPU. CVE-2026-80725 specifically impacts the logic responsible for handling 'BIG TCP' packets, which are those that exceed the standard 64KB size limit.

How does this vulnerability work?

This vulnerability is an out-of-bounds memory write issue. It stems from improper validation checks when the kernel attempts to aggregate packets beyond 64KB. Because the kernel incorrectly verifies available memory space for these large packets, it can perform operations outside of its designated memory area, potentially leading to system instability or corruption of kernel memory.

What triggers this kernel vulnerability?

An attacker triggers this by sending specially crafted network packets to the target system. The flaw is triggered when the kernel’s networking stack attempts to process these malicious packets through the GRO aggregation logic. Standard, well-formed traffic that does not attempt to bypass these specific aggregation constraints will not trigger this condition.

Do I need to worry if my Linux servers are not internet-facing?

According to Halo Surface Signal, this vulnerability is very unlikely to be exploited externally because it resides deep within the kernel's low-level network packet processing code, not in a user-facing application or service. While internal-only systems have a lower risk profile, the vulnerability still depends on the arrival of specifically crafted network traffic that could potentially be generated by an attacker who has already gained a foothold on your local network.

What are the first steps to address CVE-2026-80725?

The priority is to identify which of your Linux systems are running older, affected kernel versions. Since this issue is already resolved in mainline kernels (7.0+), focus your audit on stable branch versions like 6.18.y. Once identified, consult your Linux distribution provider’s security advisories to determine the available patched kernel packages and schedule the necessary maintenance to apply the updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.