ACK: [SRU][J][PATCH 0/2] CVE-2026-43456

[Rickey Castillo Valenzuela]

On 9/9/26 15:21, Ian Whitfield via kernel-team wrote:
> [Impact]
>
> This CVE is fixed with:
> 950803f725472 ("bonding: fix type confusion in bond_setup_by_slave()"):
>
> When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,
> bond_setup_by_slave() directly copies the slave's header_ops to the
> bond device:
>
>      bond_dev->header_ops = slave_dev->header_ops;
>
> This causes a type confusion when dev_hard_header() is later called
> on the bond device. Functions like ipgre_header(), ip6gre_header(),all use
> netdev_priv(dev) to access their device-specific private data. When
> called with the bond device, netdev_priv() returns the bond's private
> data (struct bonding) instead of the expected type (e.g. struct
> ip_tunnel), leading to garbage values being read and kernel crashes.
>
> Fix this by introducing bond_header_ops with wrapper functions that
> delegate to the active slave's header_ops using the slave's own
> device. This ensures netdev_priv() in the slave's header functions
> always receives the correct device.
>
> The fix is placed in the bonding driver rather than individual device
> drivers, as the root cause is bond blindly inheriting header_ops from
> the slave without considering that these callbacks expect a specific
> netdev_priv() layout.
>
> ---
>
> That patch requires a followup fix:
> b7405dcf73854 ("bonding: prevent potential infinite loop in bond_header_parse()")
>
> [Backport]
>
> The CVE fix commit required a context adjustment. The fix for that commit
> applied cleanly from the linux-6.6.y tree.
>
> [Fix]
>
> Resolute: Not affected, follow-up fix included
> Noble: Patched by stable upstream, follow-up fix included
> Jammy: Backport with follow-up fix
> Focal: PR on Forgejo
> Bionic: PR on Forgejo
> Xenial: PR on Forgejo
> Trusty: PR on Forgejo
>
> [Test Case]
>
> Compile and boot tested.
>
> [Where problems could occur]
>
> This fix affects those who use the Ethernet bonding driver to aggregate NICs
> together. An issue with this fix would be visible to the user as kernel BUGs in
> console or unexpected behavior after configuring a bond.
>
> Eric Dumazet (1):
>    bonding: prevent potential infinite loop in bond_header_parse()
>
> Jiayuan Chen (1):
>    bonding: fix type confusion in bond_setup_by_slave()
>
>   drivers/firewire/net.c                        |  5 +-
>   drivers/net/bonding/bond_main.c               | 49 ++++++++++++++++++-
>   drivers/net/wireless/cisco/airo.c             |  4 +-
>   .../wireless/intersil/hostap/hostap_main.c    |  1 +
>   include/linux/etherdevice.h                   |  3 +-
>   include/linux/if_ether.h                      |  3 +-
>   include/linux/netdevice.h                     |  6 ++-
>   net/ethernet/eth.c                            |  9 ++--
>   net/ipv4/ip_gre.c                             |  3 +-
>   net/mac802154/iface.c                         |  4 +-
>   net/phonet/af_phonet.c                        |  5 +-
>   11 files changed, 75 insertions(+), 17 deletions(-)
>
Acked-by: Rickey Castillo <rickey.castillo.valenzuela at canonical.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260914/291dcdff/attachment-0001.html>