[SRU][J][PATCH 0/1] CVE-2026-46266

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-46266

[ Impact ]

A RAW socket opened on protocol IPPROTO_RAW (255) could incorrectly receive
incoming packets. A malicious ICMP packet can carry an inner header with the
protocol field set to 255, matching such a socket and triggering FNHE
(Forwarding Next Hop Exception) cache changes. Per "man 7 raw", IPPROTO_RAW
implies enabled IP_HDRINCL and is send-only; receiving any IP protocol via
IPPROTO_RAW is not possible. This fix ensures these malicious packets are
dropped.

[ Fix ]

jammy: backported with AI-assisted adaptation
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A defect in this change affects the IPv4 RAW socket receive path; incorrect
matching logic could either continue to deliver packets that should be dropped
or, conversely, drop legitimate RAW socket traffic for other protocols.