CVE-2026-89555: mpls: reload header after pskb_may_pull()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mpls: reload header after pskb_may_pull()

mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop
when an MPLS route has multiple nexthops.  While walking the MPLS label
stack, the hash routine caches hdr for the current label.  After finding
the bottom-of-stack label, it calls pskb_may_pull() before reading the
inner IP header.

If an skb is constructed with the inner IP header in nonlinear data and
insufficient tailroom in the linear head, pskb_may_pull() calls
pskb_expand_head() to replace the skb head and free the old one.  This
leaves hdr pointing to freed memory.  The IPv6 path can invalidate hdr
again when it performs a second pull for the larger header.

The issue was found through static analysis.  A reproducer sending a legal
Geneve packet through a bareudp/MPLS multipath setup triggered the same
KASAN report in 2 of 2 unpatched runs:

  BUG: KASAN: slab-use-after-free in mpls_select_multipath
  Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23

  Call Trace:
   mpls_select_multipath
   mpls_forward
   __netif_receive_skb_list_core
   netif_receive_skb_list_internal
   napi_complete_done
   gro_cell_poll
   __napi_poll
   net_rx_action

  Freed by task 23:
   kfree
   pskb_expand_head
   __pskb_pull_tail
   mpls_select_multipath

Reload hdr from the current skb head after each successful pull before
deriving the inner IPv4 or IPv6 header pointer.

The Linux kernel CVE team has assigned CVE-2026-89555 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.10 with commit 9f427a0e474a67b454420c131709600d44850486 and fixed in 6.12.109 with commit fed638a248116b8a249bd4202d28e5934bdc65ad
	Issue introduced in 4.10 with commit 9f427a0e474a67b454420c131709600d44850486 and fixed in 6.18.50 with commit d82b90a38c2ca8a0694428eab0e9551c23f2447d
	Issue introduced in 4.10 with commit 9f427a0e474a67b454420c131709600d44850486 and fixed in 7.2.4 with commit 49d38c1b4390412f8950d33dfaee0ccbd17beb81
	Issue introduced in 4.10 with commit 9f427a0e474a67b454420c131709600d44850486 and fixed in 7.3-rc1 with commit 29e63b8d9fc150cc191b1c6eb7e16e1247e1b650
	Issue introduced in 4.9.8 with commit ad864d9fce0ec56cc8f6afe5c6a0e6d7f484b9eb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89555
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mpls/af_mpls.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fed638a248116b8a249bd4202d28e5934bdc65ad
	https://git.kernel.org/stable/c/d82b90a38c2ca8a0694428eab0e9551c23f2447d
	https://git.kernel.org/stable/c/49d38c1b4390412f8950d33dfaee0ccbd17beb81
	https://git.kernel.org/stable/c/29e63b8d9fc150cc191b1c6eb7e16e1247e1b650