ACK: [SRU][Q][PATCH 0/1] CVE-2026-53175

[Edoardo Canepa]

Acked-by: Edoardo Canepa <edoardo.canepa at canonical.com>

On 7/17/26 05:46, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53175
>
> [ Impact ]
>
> On network namespace teardown, fqdir_pre_exit() flushes every incomplete
> fragment queue in the fqdir rhashtable, but the flush helper frees the queued
> skbs without marking the queue complete and leaves fragments_tail and
> last_run_head pointing at the freed skbs. A fragment that had already obtained
> the queue before the flush can resume, pass the completeness check, and
> dereference the freed fragments_tail, causing a slab use-after-free. IPv6,
> nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are
> also affected. This is a high severity issue (CVSS 9.8).
>
> [ Fix ]
>
> questing: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix would affect IP fragment reassembly in the inet frags
> subsystem, potentially causing incorrect handling of fragmented IPv4/IPv6
> traffic or memory issues during network namespace teardown.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/e6e20aa4/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/e6e20aa4/attachment.sig>