In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off. inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first fragment's skb as the head of the reassembled datagram, including its shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments on frag_list with whatever linear/paged layout they arrived with. After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and the next software segmentation point - udp_rcv_segment() on local delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow path - hands it to skb_segment(). skb_segment()'s frag_list walk assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to a tap by an unprivileged user in its own userns are
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80590 addresses a critical vulnerability in Linux kernel fragment reassembly where Generic Segmentation Offload (GSO) state is not properly stripped from fragmented packets before reassembly. When packets arrive with GSO markers through virtualized network interfaces (virtio_net_hdr via tun/tap or AF_PACKET), the kernel incorrectly preserves GSO metadata in the reassembled datagram, creating a state inconsistency that can lead to memory corruption, denial of service, or potential code execution. This affects systems running vulnerable Linux kernel versions that process fragmented network traffic, particularly in cloud environments, container hosts, and systems using virtual networking interfaces. The vulnerability is especially dangerous because it operates at the network stack layer, making it exploitable through remote packet delivery without requiring local access.
While Casky's skill library currently shows zero direct matches for this specific CVE, practitioners using Casky.ai's Claude-powered analysis would benefit from its capability to detect anomalous network packet processing behaviors by mapping observable attack patterns to MITRE ATT&CK techniques like T1499 (Endpoint Denial of Service) and T1565 (Data Manipulation). Security teams should monitor kernel logs for fragment reassembly errors, unexpected memory allocation patterns during network processing, and crashes correlating with fragmented packet receipt. Extended reasoning through Casky would help correlate system-level indicators—such as unexpected kernel panics, network stack warnings, or resource exhaustion following fragmented traffic—against defensive security postures, enabling practitioners to identify exploitation attempts and prioritize patching of affected kernel versions before active exploitation occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80590. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation