[SRU][Q][PATCH 0/1] CVE-2026-53175

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53175

[ Impact ]

On network namespace teardown, fqdir_pre_exit() flushes every incomplete
fragment queue in the fqdir rhashtable, but the flush helper frees the queued
skbs without marking the queue complete and leaves fragments_tail and
last_run_head pointing at the freed skbs. A fragment that had already obtained
the queue before the flush can resume, pass the completeness check, and
dereference the freed fragments_tail, causing a slab use-after-free. IPv6,
nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are
also affected. This is a high severity issue (CVSS 9.8).

[ Fix ]

questing: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix would affect IP fragment reassembly in the inet frags
subsystem, potentially causing incorrect handling of fragmented IPv4/IPv6
traffic or memory issues during network namespace teardown.