ACK: [SRU][N][PATCH 0/1] CVE-2026-43083

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 16:32, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43083
>
> [ Impact ]
>
> The IOAM6 implementation in the IPv6 stack has an out-of-bounds access in
> __ioam6_fill_trace_data() when trace->type.bit6 is set. On the RX path
> (is_input true), skb->queue_mapping holds the ingress device's RX queue index;
> if the ingress device has more RX queues than the egress device has TX queues,
> skb_get_tx_queue() can index past the dev->_tx[] array because the index is not
> clamped. The same code path also accessed qdisc_qstats_qlen_backlog() without
> the required lock, despite being callable from both softirq and process
> contexts, leading to potential data races.
>
> [ Fix ]
>
> noble: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change could affect IPv6 IOAM6 trace data collection,
> causing incorrect queue statistics or, if the bounds check is wrong, continued
> out-of-bounds access in the network TX queue handling. Any locking error around
> qdisc_qstats_qlen_backlog() could introduce deadlocks or stalls in the netdev
> qdisc path.
>