[BUG] netfilter: ipv6: nf_defrag: u8 prev_nhoff truncation in find_prev_fhdr()

[BUG] netfilter: ipv6: nf_defrag: u8 prev_nhoff truncation in find_prev_fhdr()

[Dominik Maier]

In Linux 7.3.0 (commit c03c1a14507d), find_prev_fhdr() in
net/ipv6/netfilter/nf_conntrack_reasm.c (line 398) tracks the current
extension header offset in int start and writes the preceding header's
nexthdr offset to int *prevhoff, but declares prev_nhoff as u8.

When nf_defrag_ipv6 (CONFIG_NF_DEFRAG_IPV6=y/m) reassembles an incoming
fragmented IPv6 packet whose unfragmentable extension headers place the
header preceding the Fragment header at offset start >= 256 (for
example, start = 296 with a 40-byte IPv6 header, a 256-byte Hop-by-Hop
Options header, and an 8-byte Destination Options header at offset
296..304), assigning prev_nhoff = start truncates 296 modulo 256 to 40.

During reassembly in nf_ct_frag6_reasm(), writing
skb_network_header(head)[nhoff] = fhdr->nexthdr overwrites offset 40
(HopOpts.nexthdr) with IPPROTO_UDP (17) while leaving NEXTHDR_FRAGMENT
at offset 296 (DstOpts.nexthdr). Subsequent Netfilter hooks and
xfrm6_policy_check() (__skb_flow_dissect()) parse the 8-byte
Destination Options header as the outer UDP header, whereas
ip6_protocol_deliver_rcu() delivers the real UDP payload at
skb_transport_offset(skb) = 304 to the destination socket.

We reproduced this in QEMU by sending two IPv6 fragments containing a
256-byte Hop-by-Hop Options header and an 8-byte Destination Options
header (placing the Fragment header at offset 304), causing
nf_defrag_ipv6 to overwrite offset 40 instead of offset 296 and bypass
an inbound XFRM_POLICY_BLOCK policy on the target UDP port. The
reproducer is available upon request.

Below is a proposed fix (also tested in QEMU) changing prev_nhoff from
u8 to int to match start and *prevhoff.

Fixes: 029f7f3b8701 ("netfilter: ipv6: nf_defrag: avoid/free clone operations")
Assisted-by: ARTIST LLM
---
 net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c
b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 13bd8997f36c..8fb7380f239d 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -398,7 +398,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp,
int *prevhoff, int *fhoff)
 {
 	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 	const int netoff = skb_network_offset(skb);
-	u8 prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
+	int prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
 	int start = netoff + sizeof(struct ipv6hdr);
 	int len = skb->len - start;
 	u8 prevhdr = NEXTHDR_IPV6;

Re: [BUG] netfilter: ipv6: nf_defrag: u8 prev_nhoff truncation in find_prev_fhdr()

[Pablo Neira Ayuso]

On Mon, Oct 19, 2026 at 05:16:32AM -0500, Dominik Maier wrote:
> In Linux 7.3.0 (commit c03c1a14507d), find_prev_fhdr() in
> net/ipv6/netfilter/nf_conntrack_reasm.c (line 398) tracks the current
> extension header offset in int start and writes the preceding header's
> nexthdr offset to int *prevhoff, but declares prev_nhoff as u8.
> 
> When nf_defrag_ipv6 (CONFIG_NF_DEFRAG_IPV6=y/m) reassembles an incoming
> fragmented IPv6 packet whose unfragmentable extension headers place the
> header preceding the Fragment header at offset start >= 256 (for
> example, start = 296 with a 40-byte IPv6 header, a 256-byte Hop-by-Hop
> Options header, and an 8-byte Destination Options header at offset
> 296..304), assigning prev_nhoff = start truncates 296 modulo 256 to 40.
> 
> During reassembly in nf_ct_frag6_reasm(), writing
> skb_network_header(head)[nhoff] = fhdr->nexthdr overwrites offset 40
> (HopOpts.nexthdr) with IPPROTO_UDP (17) while leaving NEXTHDR_FRAGMENT
> at offset 296 (DstOpts.nexthdr). Subsequent Netfilter hooks and
> xfrm6_policy_check() (__skb_flow_dissect()) parse the 8-byte
> Destination Options header as the outer UDP header, whereas
> ip6_protocol_deliver_rcu() delivers the real UDP payload at
> skb_transport_offset(skb) = 304 to the destination socket.
> 
> We reproduced this in QEMU by sending two IPv6 fragments containing a
> 256-byte Hop-by-Hop Options header and an 8-byte Destination Options
> header (placing the Fragment header at offset 304), causing
> nf_defrag_ipv6 to overwrite offset 40 instead of offset 296 and bypass
> an inbound XFRM_POLICY_BLOCK policy on the target UDP port. The
> reproducer is available upon request.
> 
> Below is a proposed fix (also tested in QEMU) changing prev_nhoff from
> u8 to int to match start and *prevhoff.

Dup, for the record:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260822214012.1028305-2-Jeremy.Jean@oss.cyber.gouv.fr/

> Fixes: 029f7f3b8701 ("netfilter: ipv6: nf_defrag: avoid/free clone operations")
> Assisted-by: ARTIST LLM
> ---
>  net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c
> b/net/ipv6/netfilter/nf_conntrack_reasm.c
> index 13bd8997f36c..8fb7380f239d 100644
> --- a/net/ipv6/netfilter/nf_conntrack_reasm.c
> +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
> @@ -398,7 +398,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp,
> int *prevhoff, int *fhoff)
>  {
>  	u8 nexthdr = ipv6_hdr(skb)->nexthdr;
>  	const int netoff = skb_network_offset(skb);
> -	u8 prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
> +	int prev_nhoff = netoff + offsetof(struct ipv6hdr, nexthdr);
>  	int start = netoff + sizeof(struct ipv6hdr);
>  	int len = skb->len - start;
>  	u8 prevhdr = NEXTHDR_IPV6;