** Description changed: - TBD + [ Impact ] + CVE-2026-53362: In the Linux kernel, the following vulnerability has been resolved: + ipv6: account for fraggap on the paged allocation path + + In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as: + alloclen = fragheaderlen + transhdrlen; + pagedlen = datalen - transhdrlen; + + datalen already includes fraggap (datalen = length + fraggap). When + fraggap is non-zero, this is not the first skb and transhdrlen is zero. + The fraggap bytes carried over from the previous skb are copied just + past the fragment headers in the new skb's linear area. The linear area + is therefore undersized by fraggap bytes while pagedlen is overstated by + the same amount, and the copy writes past skb->end into the trailing + skb_shared_info. + + An unprivileged local user can trigger this via a UDPv6 socket using + MSG_MORE together with MSG_SPLICE_PAGES, leading to out-of-bounds memory + corruption, kernel panic (DoS), or local privilege escalation / + container escape. + + The following updates were made to factor fraggap into alloclen and pagedlen calculations in net/ipv6/ip6_output.c: + - alloclen = fragheaderlen + transhdrlen + fraggap; + - pagedlen = datalen - transhdrlen - fraggap; + + Upstream commit: 14200d435af9a9eeb444f529fc2f689a236b7962 + + [ Test Plan ] + 1. Boot the built kernel image in a QEMU/KVM virtual machine. + 2. Execute an IPv6 socket fragmentation test using MSG_MORE and MSG_SPLICE_PAGES carrying non-zero fraggap offsets. + 3. Verify that memory allocations complete without triggering slab OOB write warnings (KASAN) or kernel panics. + + [ Where problems could occur ] + The change only alters length accounting math during IPv6 packet payload appending. + Potential regression area: Incorrect accounting could lead to improper fragmentation drops or packet truncation on valid IPv6 traffic if fraggap calculations conflict with custom network drivers, though risks are minimal given upstream stable acceptance.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2167586 Title: CVE-2026-53362: Account for fraggap in IPv6 paged allocation path To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-hwe-6.8/+bug/2167586/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
