A flaw was found in DPDK lib/gso. hdr_segment_init() copies pkt_hdr_offset bytes from the first mbuf segment into a newly allocated header mbuf using rte_memcpy without checking that the source first segment is long enough or that the destination mbuf has enough tailroom. pkt_hdr_offset is taken from mbuf l2/l3/l4 (and outer) length fields, which applications commonly populate from packet headers including IP IHL and TCP data offset. A related uint16_t subtraction (gso_size - hdr_offset) underflows when the header is larger than gso_size. An application that runs software GSO on packets from an untrusted source (for example a guest via vhost, or scatter RX) can therefore read or write past mbuf bounds.