diff --git linux-libre-6.12.106-gnu/Makefile linux-libre-6.12.107-gnu/Makefile
index a22d82c9b7c0..5033ca3b2c80 100644
--- linux-libre-6.12.106-gnu/Makefile
+++ linux-libre-6.12.107-gnu/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 12
-SUBLEVEL = 106
+SUBLEVEL = 107
 EXTRAVERSION = -gnu
 NAME = Baby Opossum Posse
 
diff --git linux-libre-6.12.106-gnu/net/ipv4/inet_fragment.c linux-libre-6.12.107-gnu/net/ipv4/inet_fragment.c
index ea3f15f59c72..09d208cf8b1b 100644
--- linux-libre-6.12.106-gnu/net/ipv4/inet_fragment.c
+++ linux-libre-6.12.107-gnu/net/ipv4/inet_fragment.c
@@ -435,6 +435,13 @@ int inet_frag_queue_insert(struct inet_frag_queue *q, struct sk_buff *skb,
 {
 	struct sk_buff *last = q->fragments_tail;
 
+	/* An IP fragment is never a GSO packet, but an untrusted source
+	 * (virtio_net_hdr) may have attached GSO metadata to it. Do not let
+	 * that reach the reassembled skb, whose head keeps the first
+	 * fragment's shinfo and whose frag_list is not GRO-shaped.
+	 */
+	skb_gso_reset(skb);
+
 	/* RFC5722, Section 4, amended by Errata ID : 3089
 	 *                          When reassembling an IPv6 datagram, if
 	 *   one or more its constituent fragments is determined to be an
