Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #93922 > unrolled thread

Bug#1146105: [PATCH] src:linux: CVE-2026-80725 backport for bookworm

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1146105: [PATCH] src:linux: CVE-2026-80725 backport for bookworm Daniel Pereira <danielmaraboo@gmail.com> - 2026-08-29 23:20 +0200
    Bug#1146105: [PATCH v2] src:linux: CVE-2026-80725 backport for bookworm Daniel Pereira <danielmaraboo@gmail.com> - 2026-08-30 06:30 +0200
    Bug#1146105: marked as done ([PATCH] src:linux: CVE-2026-80725  backport for bookworm) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-08-30 06:40 +0200

#93922 — Bug#1146105: [PATCH] src:linux: CVE-2026-80725 backport for bookworm

Package: src:linux
Version: 6.1.180-1
Severity: important
Tags: patch security

Dear Debian Kernel Team,

I noticed that CVE-2026-80725 is currently vulnerable in Debian Bookworm (6.1.x), although it has been fixed in Sid and upstream.
I have prepared and tested a backport of the upstream fix (commit 81be30c1f5f2bffda1f04c0efd0746af10b9643a) for the 6.1 kernel tree.

---
From: Alice Mikityanska <alice@isovalent.com>
Date: Thu, 5 Feb 2026 15:39:16 +0200
Subject: net/ipv6: Drop HBH for BIG TCP on RX side
Origin: upstream, https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-80725
Description: Complementary to the previous commit, stop inserting HBH when building
 BIG TCP GRO SKBs.
 [ Daniel Pereira ] Backported to 6.1 by removing memmove in ip6_offload.c
 and adjusting iph->payload_len logic to match 6.1 context.

Index: linux-6.1.176/net/core/gro.c
===================================================================
--- linux-6.1.176.orig/net/core/gro.c
+++ linux-6.1.176/net/core/gro.c
@@ -182,7 +182,6 @@ int skb_gro_receive(struct sk_buff *p, s
 
 	if (unlikely(p->len + len >= GRO_LEGACY_MAX_SIZE)) {
 		if (p->protocol != htons(ETH_P_IPV6) ||
-		    skb_headroom(p) < sizeof(struct hop_jumbo_hdr) ||
 		    ipv6_hdr(p)->nexthdr != IPPROTO_TCP ||
 		    p->encapsulation)
 			return -E2BIG;
Index: linux-6.1.176/net/ipv6/ip6_offload.c
===================================================================
--- linux-6.1.176.orig/net/ipv6/ip6_offload.c
+++ linux-6.1.176/net/ipv6/ip6_offload.c
@@ -350,34 +350,8 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_com
 		skb_set_inner_network_header(skb, nhoff);
 	}
 
-	payload_len = skb->len - nhoff - sizeof(*iph);
-	if (unlikely(payload_len > IPV6_MAXPLEN)) {
-		struct hop_jumbo_hdr *hop_jumbo;
-		int hoplen = sizeof(*hop_jumbo);
-
-		/* Move network header left */
-		memmove(skb_mac_header(skb) - hoplen, skb_mac_header(skb),
-			skb->transport_header - skb->mac_header);
-		skb->data -= hoplen;
-		skb->len += hoplen;
-		skb->mac_header -= hoplen;
-		skb->network_header -= hoplen;
-		iph = (struct ipv6hdr *)(skb->data + nhoff);
-		hop_jumbo = (struct hop_jumbo_hdr *)(iph + 1);
-
-		/* Build hop-by-hop options */
-		hop_jumbo->nexthdr = iph->nexthdr;
-		hop_jumbo->hdrlen = 0;
-		hop_jumbo->tlv_type = IPV6_TLV_JUMBO;
-		hop_jumbo->tlv_len = 4;
-		hop_jumbo->jumbo_payload_len = htonl(payload_len + hoplen);
-
-		iph->nexthdr = NEXTHDR_HOP;
-		iph->payload_len = 0;
-	} else {
-		iph = (struct ipv6hdr *)(skb->data + nhoff);
-		iph->payload_len = htons(payload_len);
-	}
+	iph = (struct ipv6hdr *)(skb->data + nhoff);
+	iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
 
 	nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops);
 	if (WARN_ON(!ops || !ops->callbacks.gro_complete))

[toc] | [next] | [standalone]

#93926 — Bug#1146105: [PATCH v2] src:linux: CVE-2026-80725 backport for bookworm

Package: src:linux
Version: 6.1.180-1
Severity: important
Tags: patch security

Dear Debian Kernel Team,

I noticed that CVE-2026-80725 is currently vulnerable in Debian Bookworm (6.1.x), although it has been fixed in Sid and upstream.
I have prepared and tested a backport of the upstream fix (commit 81be30c1f5f2bffda1f04c0efd0746af10b9643a) for the 6.1 kernel tree.

---
Changes in v2:
- Removed unused 'payload_len' variable in ipv6_gro_complete to fix -Werror build failure.

From: Alice Mikityanska <alice@isovalent.com>
Date: Thu, 5 Feb 2026 15:39:16 +0200
Subject: net/ipv6: Drop HBH for BIG TCP on RX side
Origin: upstream, https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-80725
Description: Complementary to the previous commit, stop inserting HBH when building
 BIG TCP GRO SKBs.
 [ Daniel Pereira ] Backported to 6.1 by removing memmove in ip6_offload.c
 and adjusting iph->payload_len logic to match 6.1 context.

Index: linux-6.1.176/net/core/gro.c
===================================================================
--- linux-6.1.176.orig/net/core/gro.c
+++ linux-6.1.176/net/core/gro.c
@@ -182,7 +182,6 @@ int skb_gro_receive(struct sk_buff *p, s
 
 	if (unlikely(p->len + len >= GRO_LEGACY_MAX_SIZE)) {
 		if (p->protocol != htons(ETH_P_IPV6) ||
-		    skb_headroom(p) < sizeof(struct hop_jumbo_hdr) ||
 		    ipv6_hdr(p)->nexthdr != IPPROTO_TCP ||
 		    p->encapsulation)
 			return -E2BIG;
Index: linux-6.1.176/net/ipv6/ip6_offload.c
===================================================================
--- linux-6.1.176.orig/net/ipv6/ip6_offload.c
+++ linux-6.1.176/net/ipv6/ip6_offload.c
@@ -344,40 +344,13 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
 {
 	const struct net_offload *ops;
 	struct ipv6hdr *iph;
 	int err = -ENOSYS;
-	u32 payload_len;
 
 	if (skb->encapsulation) {
 		skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IPV6));
 		skb_set_inner_network_header(skb, nhoff);
 	}
 
-	payload_len = skb->len - nhoff - sizeof(*iph);
-	if (unlikely(payload_len > IPV6_MAXPLEN)) {
-		struct hop_jumbo_hdr *hop_jumbo;
-		int hoplen = sizeof(*hop_jumbo);
-
-		/* Move network header left */
-		memmove(skb_mac_header(skb) - hoplen, skb_mac_header(skb),
-			skb->transport_header - skb->mac_header);
-		skb->data -= hoplen;
-		skb->len += hoplen;
-		skb->mac_header -= hoplen;
-		skb->network_header -= hoplen;
-		iph = (struct ipv6hdr *)(skb->data + nhoff);
-		hop_jumbo = (struct hop_jumbo_hdr *)(iph + 1);
-
-		/* Build hop-by-hop options */
-		hop_jumbo->nexthdr = iph->nexthdr;
-		hop_jumbo->hdrlen = 0;
-		hop_jumbo->tlv_type = IPV6_TLV_JUMBO;
-		hop_jumbo->tlv_len = 4;
-		hop_jumbo->jumbo_payload_len = htonl(payload_len + hoplen);
-
-		iph->nexthdr = NEXTHDR_HOP;
-		iph->payload_len = 0;
-	} else {
-		iph = (struct ipv6hdr *)(skb->data + nhoff);
-		iph->payload_len = htons(payload_len);
-	}
+	iph = (struct ipv6hdr *)(skb->data + nhoff);
+	iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
 
 	nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops);
 	if (WARN_ON(!ops || !ops->callbacks.gro_complete))

[toc] | [prev] | [next] | [standalone]

#93927 — Bug#1146105: marked as done ([PATCH] src:linux: CVE-2026-80725 backport for bookworm)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Sun, 30 Aug 2026 06:34:57 +0200
with message-id <apOy8ZJ0itVizggG@eldamar.lan>
and subject line Re: Bug#1146105: [PATCH] src:linux: CVE-2026-80725 backport for bookworm
has caused the Debian Bug report #1146105,
regarding [PATCH] src:linux: CVE-2026-80725 backport for bookworm
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1146105: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146105
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web