Eight Stable Linux Kernels Patch a GSO Fragmentation Flaw Present Since Kernel 2.6.27

Overview

Greg Kroah-Hartman has announced the release of eight stable and longterm Linux kernel versions — 7.2.2, 7.1.12, 6.18.48, 6.12.107, 6.6.155, 6.1.186, 5.15.219, and 5.10.268 — each carrying a single fix for CVE-2026-80590, according to LWN. The vulnerability allows marking IPv4 or IPv6 fragments as GSO (Generic Segmentation Offload), which can let an unprivileged user cause a kernel panic, and it has been present in the kernel since version 2.6.27, according to LWN.

What We Know

Each of the eight releases contains only that one fix, according to LWN, which reported that “users are advised to upgrade.” The official kernel.org release listing independently confirms all eight version numbers, showing 7.2.2 and 7.1.12 as the current stable releases and 6.18.48, 6.12.107, 6.6.155, 6.1.186, 5.15.219, and 5.10.268 as longterm releases, all dated August 28, 2026.

The fix does not appear to have propagated evenly across downstream distributions yet. The Debian Security Tracker shows the kernel packages in Debian’s bullseye, bookworm, trixie, and forky releases still marked vulnerable, with only the unstable “sid” branch showing a fixed package, at version 7.1.12-1.

The 7.2.2 fix follows the Linux 7.2 release that shipped earlier this month with cache-aware CPU scheduling and default Btrfs large folios.

What We Don’t Know

LWN’s report does not name who discovered or reported the vulnerability, nor does it give a CVSS severity score, and none was available in the Debian Security Tracker entry either. It is also not yet clear when Debian’s bullseye, bookworm, trixie, and forky branches will receive backported fixes, or whether other downstream distributions have shipped updated packages.

Analysis

The bug’s age is notable on its own terms: LWN dates it back to Linux 2.6.27, meaning the flawed code path has shipped in every kernel release since, across nearly two decades of stable and longterm maintenance branches, before being caught and fixed in this batch of releases. Because the flaw is reachable by an unprivileged user and produces a kernel panic rather than a privilege escalation, its practical impact is a denial-of-service risk on any system that allows untrusted local users or processes to send crafted network traffic — a class of bug that tends to affect shared hosting, container platforms, and other multi-tenant Linux deployments most directly.