CVE-2026-80725: net: gro: properly validate BIG TCP aggregation criteria

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: gro: properly validate BIG TCP aggregation criteria

When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),
BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP
(with sufficient MAC header room to insert the temporary HBH jumbo header).

However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp")
loosened the check in skb_gro_receive(), leading to several issues:

1. skb_gro_receive() checked skb_headroom(p) instead of the actual space
   before the MAC header (p->mac_header). Because skb_headroom(p) includes
   mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check
   with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the
   temporary HBH jumbo header, the memmove() starts before skb->head,
   causing an out-of-bounds write and wrapping skb->mac_header.
2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /
   ETH_P_8021AD) to aggregate beyond 64KB because
   p->protocol != ETH_P_IPV6 was true.
3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark,
   allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate
   beyond 64KB.

Fix skb_gro_receive() to strictly enforce:
- NAPI_GRO_CB(skb)->proto == IPPROTO_TCP
- Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation)
- Protocol must be either ETH_P_IP or ETH_P_IPV6
- If ETH_P_IPV6, p->mac_header must be at least
  sizeof(struct hop_jumbo_hdr)

Returning -E2BIG from skb_gro_receive() ensures that packets which cannot
become BIG TCP are cleanly flushed at <= 64KB and delivered intact without
dropping.

This issue does not exist in mainline (7.0+) because the subsystem was
rewritten in commit 81be30c1f5f2 ("net/ipv6: Drop HBH for BIG TCP on RX
side"), making this fix relevant only for older stable branches like
6.18.y.

The Linux kernel CVE team has assigned CVE-2026-80725 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 and fixed in 6.1.185 with commit 37a5dcd6837fc2afc44a7bc3ed8af4e983783d46
	Issue introduced in 5.19 with commit 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 and fixed in 6.6.154 with commit e907bf694ed55bdfe421be99dba35751a655df25
	Issue introduced in 5.19 with commit 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 and fixed in 6.12.106 with commit 03cb8cc2961f5f781d12e903782cb3815ed84b1c
	Issue introduced in 5.19 with commit 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 and fixed in 6.18.47 with commit 3ce832e2bd431d0c12ba525ed73ad8fbc4191da5
	Issue introduced in 5.19 with commit 0fe79f28bfaf73b66b7b1562d2468f94aa03bd12 and fixed in 7.0 with commit 81be30c1f5f2bffda1f04c0efd0746af10b9643a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80725
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/core/gro.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/37a5dcd6837fc2afc44a7bc3ed8af4e983783d46
	https://git.kernel.org/stable/c/e907bf694ed55bdfe421be99dba35751a655df25
	https://git.kernel.org/stable/c/03cb8cc2961f5f781d12e903782cb3815ed84b1c
	https://git.kernel.org/stable/c/81be30c1f5f2bffda1f04c0efd0746af10b9643a
	https://git.kernel.org/stable/c/3ce832e2bd431d0c12ba525ed73ad8fbc4191da5