ACK: [SRU][Q][PATCH 0/1] CVE-2026-53175

[Tim Whisonant]

On Fri, Jul 17, 2026 at 06:46:13AM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53175
> 
> [ Impact ]
> 
> On network namespace teardown, fqdir_pre_exit() flushes every incomplete
> fragment queue in the fqdir rhashtable, but the flush helper frees the queued
> skbs without marking the queue complete and leaves fragments_tail and
> last_run_head pointing at the freed skbs. A fragment that had already obtained
> the queue before the flush can resume, pass the completeness check, and
> dereference the freed fragments_tail, causing a slab use-after-free. IPv6,
> nf_conntrack_reasm6 and 6lowpan reassembly share the same flush path and are
> also affected. This is a high severity issue (CVSS 9.8).
> 
> [ Fix ]
> 
> questing: clean cherry-pick
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression in this fix would affect IP fragment reassembly in the inet frags
> subsystem, potentially causing incorrect handling of fragmented IPv4/IPv6
> traffic or memory issues during network namespace teardown.
> 

Acked-by: Tim Whisonant <tim.whisonant at canonical.com>