[SRU][Q/N/J][PATCH 0/3] CVE-2026-53228

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53228

[ Impact ]

ipip6_tunnel_xmit() in the SIT tunnel driver caches the inner IPv6 header
pointer at function entry and continues using it after
iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() can call
skb_header_unclone(), which may invoke pskb_expand_head() and move the skb
head, leaving the cached pointer stale. If the skb_realloc_headroom() branch is
not taken, SIT reads the inner hop limit and DS field through the stale
pointer, resulting in a use-after-free read from a freed skb head. This is a
memory-safety flaw with a CVSS score of 9.8.

[ Fix ]

questing: clean cherry-pick
noble: clean cherry-pick
jammy: clean cherry-pick
focal: clean cherry-pick
bionic: clean cherry-pick
xenial: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression would be limited to the IPv6 SIT tunnel transmit path; an
incorrect fix could cause reloading the inner header pointer at the wrong
point, leading to malformed encapsulated packets or crashes when transmitting
GSO traffic over sit/UDP foo-over-udp tunnels.