APPLIED: [SRU][Q][PATCH 0/1] CVE-2026-43037

[Mehmet Basaran]

Applied to questing:linux master-next branch. Thanks.

-------------- next part --------------
Cengiz Can via kernel-team <kernel-team at lists.ubuntu.com> writes:

> https://ubuntu.com/security/CVE-2026-43037
>
> [ Impact ]
>
> ip4ip6_err() in the IPv6 tunnel code calls icmp_send() on a cloned skb whose
> cb[] was previously written by the IPv6 receive path as struct inet6_skb_parm.
> icmp_send() then passes IPCB(skb2) to __ip_options_echo(), which reinterprets
> that cb[] region as struct inet_skb_parm (IPv4), where inet6_skb_parm.nhoff
> overlaps inet_skb_parm.opt.rr and yields a non-zero rr value. As a result,
> __ip_options_echo() reads an attacker-controlled optlen from packet data and
> copies that many bytes into a fixed 40-byte stack buffer, causing memory
> corruption. This is a remotely triggerable issue with a CVSS score of 9.8.
>
> [ Fix ]
>
> questing: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: clean cherry-pick
> trusty: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> The fix clears skb2->cb[] and adds minimal IPv4 header validation (version ==
> 4, ihl >= 5) in the ip6_tunnel error path. If incorrect, regressions would be
> confined to the IPv4-over-IPv6 tunnel (ip6_tunnel) error handling, potentially
> affecting ICMP error delivery for tunneled traffic.
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 873 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260620/5d08c2fa/attachment.sig>