ACK: [SRU][Q/N/J][PATCH 0/3] CVE-2026-53228

[Alessio Faina]

On Fri, Jul 17, 2026 at 01:43:57PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53228
> 
> [ Impact ]
> 
> ipip6_tunnel_xmit() in the SIT tunnel driver caches the inner IPv6 header
> pointer at function entry and continues using it after
> iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() can call
> skb_header_unclone(), which may invoke pskb_expand_head() and move the skb
> head, leaving the cached pointer stale. If the skb_realloc_headroom() branch is
> not taken, SIT reads the inner hop limit and DS field through the stale
> pointer, resulting in a use-after-free read from a freed skb head. This is a
> memory-safety flaw with a CVSS score of 9.8.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> noble: clean cherry-pick
> jammy: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression would be limited to the IPv6 SIT tunnel transmit path; an
> incorrect fix could cause reloading the inner header pointer at the wrong
> point, leading to malformed encapsulated packets or crashes when transmitting
> GSO traffic over sit/UDP foo-over-udp tunnels.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Alessio Faina <alessio.faina at canonical.com>