Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #93926

Bug#1146105: [PATCH v2] src:linux: CVE-2026-80725 backport for bookworm

Cross-posted to 2 groups.

Show key headers only | View raw

Package: src:linux
Version: 6.1.180-1
Severity: important
Tags: patch security

Dear Debian Kernel Team,

I noticed that CVE-2026-80725 is currently vulnerable in Debian Bookworm (6.1.x), although it has been fixed in Sid and upstream.
I have prepared and tested a backport of the upstream fix (commit 81be30c1f5f2bffda1f04c0efd0746af10b9643a) for the 6.1 kernel tree.

---
Changes in v2:
- Removed unused 'payload_len' variable in ipv6_gro_complete to fix -Werror build failure.

From: Alice Mikityanska <alice@isovalent.com>
Date: Thu, 5 Feb 2026 15:39:16 +0200
Subject: net/ipv6: Drop HBH for BIG TCP on RX side
Origin: upstream, https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-80725
Description: Complementary to the previous commit, stop inserting HBH when building
 BIG TCP GRO SKBs.
 [ Daniel Pereira ] Backported to 6.1 by removing memmove in ip6_offload.c
 and adjusting iph->payload_len logic to match 6.1 context.

Index: linux-6.1.176/net/core/gro.c
===================================================================
--- linux-6.1.176.orig/net/core/gro.c
+++ linux-6.1.176/net/core/gro.c
@@ -182,7 +182,6 @@ int skb_gro_receive(struct sk_buff *p, s
 
 	if (unlikely(p->len + len >= GRO_LEGACY_MAX_SIZE)) {
 		if (p->protocol != htons(ETH_P_IPV6) ||
-		    skb_headroom(p) < sizeof(struct hop_jumbo_hdr) ||
 		    ipv6_hdr(p)->nexthdr != IPPROTO_TCP ||
 		    p->encapsulation)
 			return -E2BIG;
Index: linux-6.1.176/net/ipv6/ip6_offload.c
===================================================================
--- linux-6.1.176.orig/net/ipv6/ip6_offload.c
+++ linux-6.1.176/net/ipv6/ip6_offload.c
@@ -344,40 +344,13 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
 {
 	const struct net_offload *ops;
 	struct ipv6hdr *iph;
 	int err = -ENOSYS;
-	u32 payload_len;
 
 	if (skb->encapsulation) {
 		skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IPV6));
 		skb_set_inner_network_header(skb, nhoff);
 	}
 
-	payload_len = skb->len - nhoff - sizeof(*iph);
-	if (unlikely(payload_len > IPV6_MAXPLEN)) {
-		struct hop_jumbo_hdr *hop_jumbo;
-		int hoplen = sizeof(*hop_jumbo);
-
-		/* Move network header left */
-		memmove(skb_mac_header(skb) - hoplen, skb_mac_header(skb),
-			skb->transport_header - skb->mac_header);
-		skb->data -= hoplen;
-		skb->len += hoplen;
-		skb->mac_header -= hoplen;
-		skb->network_header -= hoplen;
-		iph = (struct ipv6hdr *)(skb->data + nhoff);
-		hop_jumbo = (struct hop_jumbo_hdr *)(iph + 1);
-
-		/* Build hop-by-hop options */
-		hop_jumbo->nexthdr = iph->nexthdr;
-		hop_jumbo->hdrlen = 0;
-		hop_jumbo->tlv_type = IPV6_TLV_JUMBO;
-		hop_jumbo->tlv_len = 4;
-		hop_jumbo->jumbo_payload_len = htonl(payload_len + hoplen);
-
-		iph->nexthdr = NEXTHDR_HOP;
-		iph->payload_len = 0;
-	} else {
-		iph = (struct ipv6hdr *)(skb->data + nhoff);
-		iph->payload_len = htons(payload_len);
-	}
+	iph = (struct ipv6hdr *)(skb->data + nhoff);
+	iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
 
 	nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops);
 	if (WARN_ON(!ops || !ops->callbacks.gro_complete))

Back to linux.debian.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1146105: [PATCH] src:linux: CVE-2026-80725 backport for bookworm Daniel Pereira <danielmaraboo@gmail.com> - 2026-08-29 23:20 +0200
  Bug#1146105: [PATCH v2] src:linux: CVE-2026-80725 backport for bookworm Daniel Pereira <danielmaraboo@gmail.com> - 2026-08-30 06:30 +0200
  Bug#1146105: marked as done ([PATCH] src:linux: CVE-2026-80725  backport for bookworm) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-08-30 06:40 +0200

csiph-web