PT-2026-114380 · Linux · Linux
CVE-2026-98401
·
Publicado
2026-10-14
·
Atualizado
2026-10-14
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net: iptunnel: fix stale transport header during tunnel decapsulation
Syzbot reported a crash in qdisc pkt len segs init() caused by a stale
transport header offset after tunnel decapsulation.
BUG: unable to handle page fault for address: ffffed102091a42e
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 340 Comm: qdisc uaf repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010: asan load2
qdisc pkt len segs init (net/core/dev.c:4145)
dev queue xmit (net/core/dev.c:4787)
br dev queue push xmit (net/bridge/br forward.c:53)
br handle frame finish (net/bridge/br input.c:229)
br handle frame (net/bridge/br input.c:315)
netif receive skb core.constprop.0 (net/core/dev.c:6099)
netif receive skb list core (net/core/dev.c:6287)
netif receive skb list internal (net/core/dev.c:6445)
napi complete done (net/core/dev.c:6813)
gro cell poll (net/core/gro cells.c:74)
napi poll (net/core/dev.c:7735)
net rx action (net/core/dev.c:7798 net/core/dev.c:7955)
handle softirqs (kernel/softirq.c:622)
do softirq (kernel/softirq.c:523 kernel/softirq.c:510 )
local bh enable ip (kernel/softirq.c:450)
tun get user (drivers/net/tun.c:1986 (discriminator 1))
tun chr write iter (drivers/net/tun.c:2032)
The issue is completely latent until qdisc read transport header in
commit 7fb4c1967011 ("net: pull headers in qdisc pkt len segs init()").
The crash requires four conditions to line up:
- The incoming packet is encapsulated and carries GSO metadata. The outer transport header offset is stored in skb->transport header while the packet is still in the outer tunnel context.
- The tunnel receiver strips the outer headers. skb->data is advanced to the inner frame, but skb->transport header is left pointing to the now-removed outer L4 header, so it becomes a negative offset relative to the new data.
- The inner frame is not delivered to the local IP stack. Instead, it is forwarded at L2 by a bridge or HSR, so ip rcv core() never runs and the transport header is not reset to the inner L4 offset.
- The forwarding path calls dev queue xmit(), which enters qdisc pkt len segs init(). That function computes the GSO header length from skb transport offset(skb). Because the offset is negative, the unsigned cast overflows and pskb may pull(skb, hdr len + sizeof(struct tcphdr)) reads past the end of the skb, triggering a KASAN fault or page fault.
The issue specifically requires GSO packets (shinfo->gso size != 0), which
are processed/aggregated through gro cells. Fix this by clearing
transport header to the ~0U sentinel in gro cell for all tunnnel driver.
GTP does not support GRO/GSO, drop the evil GSO packets in GTP directly.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux