Repository navigation
VULN-185348: kernel P3 escalation (CVE-2026-46300) [3 sibling(s) escalated separately] - #1762
Closed
jason-rodri wants to merge 1 commit into
Conversation
jira VULN-185348 cve CVE-2026-46300 commit-author William Bowling <vakzz@zellic.io> commit f84eca5 upstream-diff | Added propagation of shared-frag marker during coalescing: when from_shinfo has frags, OR their tx_flags into to_shinfo's tx_flags masked with SKBTX_SHARED_FRAG. Adapted from original which used flags/SKBFL_SHARED_FRAG to target tree's tx_flags/SKBTX_SHARED_FRAG. skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. Fixes: cef401d ("net: fix possible wrong checksum generation") Fixes: f4c50a4 ("xfrm: esp: avoid in-place decrypt on shared skb frags") Signed-off-by: William Bowling <vakzz@zellic.io> Reviewed-by: Eric Dumazet <edumazet@google.com> Tested-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://patch.msgid.link/20260513041635.1289541-1-vakzz@zellic.io Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit f84eca5) Signed-off-by: pmp <pmp@noreply.invalid>
Author
|
Superseded by a rerun with a higher repair-agent step budget (CVE-2026-43284's adaptation was mid-investigation, not stuck, per the attempted diff above). |
🔍 Diffofdiffs: 1 backport differs from upstreamOpen to anyone signed in to GitHub. Report expires 2027-02-02 15:19 UTC.
Checked PR revision |
|
🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/41858210301 |
JIRA PR Check Results1 commit(s) with issues found: Commit
|
|
❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/41858210301 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Produced by the kernel P3 escalation agent (ctrliq/narf-agent, agent/kernel_adapt.py). Opening for review, not auto-merge.
f84eca581739See ctrliq/narf-agent#12 for open questions on this path (PR convention, target-branch confirmation) before this should merge.
Escalated sibling(s) from this run
VULN-184864 (CVE-2026-43284) -- NOT included, escalated
f4c50a4034e6: max_steps (48) reachedAttempted diff (not committed)
VULN-184864 (CVE-2026-43284) -- NOT included, escalated
fe785bb3a809: not attempted -- an earlier pick in this run escalated firstVULN-184864 (CVE-2026-43284) -- NOT included, escalated
8253aab4659c: not attempted -- an earlier pick in this run escalated first