ACK: [SRU][J][PATCH 0/1] CVE-2026-46266

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/27/26 03:27, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-46266
>
> [ Impact ]
>
> A RAW socket opened on protocol IPPROTO_RAW (255) could incorrectly receive
> incoming packets. A malicious ICMP packet can carry an inner header with the
> protocol field set to 255, matching such a socket and triggering FNHE
> (Forwarding Next Hop Exception) cache changes. Per "man 7 raw", IPPROTO_RAW
> implies enabled IP_HDRINCL and is send-only; receiving any IP protocol via
> IPPROTO_RAW is not possible. This fix ensures these malicious packets are
> dropped.
>
> [ Fix ]
>
> jammy: backported with AI-assisted adaptation
> trusty: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A defect in this change affects the IPv4 RAW socket receive path; incorrect
> matching logic could either continue to deliver packets that should be dropped
> or, conversely, drop legitimate RAW socket traffic for other protocols.
>