Package: src:linux Version: 6.1.180-1 Severity: important Tags: patch security
Dear Debian Kernel Team, I noticed that CVE-2026-80725 is currently vulnerable in Debian Bookworm (6.1.x), although it has been fixed in Sid and upstream. I have prepared and tested a backport of the upstream fix (commit 81be30c1f5f2bffda1f04c0efd0746af10b9643a) for the 6.1 kernel tree. --- From: Alice Mikityanska <[email protected]> Date: Thu, 5 Feb 2026 15:39:16 +0200 Subject: net/ipv6: Drop HBH for BIG TCP on RX side Origin: upstream, https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-80725 Description: Complementary to the previous commit, stop inserting HBH when building BIG TCP GRO SKBs. [ Daniel Pereira ] Backported to 6.1 by removing memmove in ip6_offload.c and adjusting iph->payload_len logic to match 6.1 context. Index: linux-6.1.176/net/core/gro.c =================================================================== --- linux-6.1.176.orig/net/core/gro.c +++ linux-6.1.176/net/core/gro.c @@ -182,7 +182,6 @@ int skb_gro_receive(struct sk_buff *p, s if (unlikely(p->len + len >= GRO_LEGACY_MAX_SIZE)) { if (p->protocol != htons(ETH_P_IPV6) || - skb_headroom(p) < sizeof(struct hop_jumbo_hdr) || ipv6_hdr(p)->nexthdr != IPPROTO_TCP || p->encapsulation) return -E2BIG; Index: linux-6.1.176/net/ipv6/ip6_offload.c =================================================================== --- linux-6.1.176.orig/net/ipv6/ip6_offload.c +++ linux-6.1.176/net/ipv6/ip6_offload.c @@ -350,34 +350,8 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_com skb_set_inner_network_header(skb, nhoff); } - payload_len = skb->len - nhoff - sizeof(*iph); - if (unlikely(payload_len > IPV6_MAXPLEN)) { - struct hop_jumbo_hdr *hop_jumbo; - int hoplen = sizeof(*hop_jumbo); - - /* Move network header left */ - memmove(skb_mac_header(skb) - hoplen, skb_mac_header(skb), - skb->transport_header - skb->mac_header); - skb->data -= hoplen; - skb->len += hoplen; - skb->mac_header -= hoplen; - skb->network_header -= hoplen; - iph = (struct ipv6hdr *)(skb->data + nhoff); - hop_jumbo = (struct hop_jumbo_hdr *)(iph + 1); - - /* Build hop-by-hop options */ - hop_jumbo->nexthdr = iph->nexthdr; - hop_jumbo->hdrlen = 0; - hop_jumbo->tlv_type = IPV6_TLV_JUMBO; - hop_jumbo->tlv_len = 4; - hop_jumbo->jumbo_payload_len = htonl(payload_len + hoplen); - - iph->nexthdr = NEXTHDR_HOP; - iph->payload_len = 0; - } else { - iph = (struct ipv6hdr *)(skb->data + nhoff); - iph->payload_len = htons(payload_len); - } + iph = (struct ipv6hdr *)(skb->data + nhoff); + iph->payload_len = htons(skb->len - nhoff - sizeof(*iph)); nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops); if (WARN_ON(!ops || !ops->callbacks.gro_complete))
