CVE-2026-99191

In the Linux kernel, the following vulnerability has been resolved:

calipso: keep BIG TCP payload len in calipso skbuff setattr()

calipso skbuff setattr() adjusts payload len by the length of the option it inserts or resizes:

payload = ntohs(ip6 hdr->payload len);
ip6 hdr->payload len = htons(payload + len delta);

GRO can build BIG TCP packets larger than IPV6 MAXPLEN, and stores payload len == 0 for them; ipv6 payload len() then falls back to skb->len. For such a packet forwarded to a destination mapped to CALIPSO, the code above writes len delta (or 65536 + len delta when shrinking) into payload len, and ipv6 payload len() no longer falls back to skb->len. nf tables, conntrack and sch cake rely on it.

The same arithmetic also wraps when a packet grows past IPV6 MAXPLEN, and a BIG TCP packet that shrinks below IPV6 MAXPLEN should get its real length back.

Set payload len from the skb length with ipv6 set payload len(), which stores 0 above IPV6 MAXPLEN and the real length otherwise, as ipv6 gro complete() does. The network header was just reset to skb->data, so skb->len - sizeof(*ip6 hdr) is the payload length.

Tested on one kernel (arm64, QEMU) with SELinux permissive, a minimal mdp-generated policy (network peer controls=1), "netlabelctl calipso add pass doi:16" and a NetLabel mapping of fd00:2::/64 to CALIPSO DOI 16. calipso skbuff setattr() was called through netlbl skbuff setattr() from a test-only debugfs hook (not part of this patch) adding a level-only label; payload len after the call:

case before fix after fix real length 1000, unlabeled 1016 1016 1016 70000 GSO, payload len 0 16 0 70016 65530 GSO, grows past MAXPLEN 10 0 65546 65540 GSO with a 24 byte hop header, shrinks below MAXPLEN 65528 65532 65532 1000 with a 24 byte hop header 992 992 992

(0 means ipv6 payload len() returns the real length.) On the forward path, with a client injecting unlabeled UDP through a router to a server, the router adds the CALIPSO option and the server delivers all datagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.