APPLIED[HWE-6.17/N/J]/Cmnt: [SRU][Q/N/J][PATCH 0/3] CVE-2026-53228

[Stefan Bader]

On 17/07/2026 12:43, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53228
> 
> [ Impact ]
> 
> ipip6_tunnel_xmit() in the SIT tunnel driver caches the inner IPv6 header
> pointer at function entry and continues using it after
> iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() can call
> skb_header_unclone(), which may invoke pskb_expand_head() and move the skb
> head, leaving the cached pointer stale. If the skb_realloc_headroom() branch is
> not taken, SIT reads the inner hop limit and DS field through the stale
> pointer, resulting in a use-after-free read from a freed skb head. This is a
> memory-safety flaw with a CVSS score of 9.8.
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> noble: clean cherry-pick
> jammy: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression would be limited to the IPv6 SIT tunnel transmit path; an
> incorrect fix could cause reloading the inner header pointer at the wrong
> point, leading to malformed encapsulated packets or crashes when transmitting
> GSO traffic over sit/UDP foo-over-udp tunnels.
> 

Applied to noble,jammy:linux/master-next and 
noble:linux-hwe-6.17/hwe-6.17-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 52669 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260717/9b99b8fc/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260717/9b99b8fc/attachment-0001.sig>