CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back.  The
recompressed header can be larger than the received one when the swap
reduces the common-prefix length the segments share with daddr (CmprI=0,
CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).

pskb_expand_head() was gated on segments_left == 0, so on earlier
segments the push consumed unchecked headroom.  Once skb_push() leaves
fewer than skb->mac_len bytes in front of data,
skb_mac_header_rebuild()'s call to:

	skb_set_mac_header(skb, -skb->mac_len);

will store (data - head) - mac_len into the u16 mac_header field, which
wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB
past skb->head.

A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two
segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one
pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.

Fix this by expanding the head whenever the remaining room is less than
the push size plus mac_len, and request that much extra so the rebuilt
MAC header fits afterwards.

The Linux kernel CVE team has assigned CVE-2026-43501 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.7 with commit 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and fixed in 6.6.140 with commit 8e8be63465a5e80394c70324603dfea1bfdad48f
	Issue introduced in 5.7 with commit 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and fixed in 6.12.86 with commit 4babc2d9fda2df43823b85d08a0180b68f1b0854
	Issue introduced in 5.7 with commit 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and fixed in 6.18.27 with commit c261d07a80576dc8ccf394ef8f074f8c67a06b37
	Issue introduced in 5.7 with commit 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and fixed in 7.0.4 with commit 7398ebefbfd4f8a31d4f665a4213302fa995494b
	Issue introduced in 5.7 with commit 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 and fixed in 7.1-rc2 with commit 9e6bf146b55999a095bb14f73a843942456d1adc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-43501
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/exthdrs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f
	https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854
	https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37
	https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b
	https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc