Your message dated Sun, 30 Aug 2026 06:34:57 +0200
with message-id <[email protected]>
and subject line Re: Bug#1146105: [PATCH] src:linux: CVE-2026-80725 backport
for bookworm
has caused the Debian Bug report #1146105,
regarding [PATCH] src:linux: CVE-2026-80725 backport for bookworm
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146105: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146105
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: src:linux
Version: 6.1.180-1
Severity: important
Tags: patch security
Dear Debian Kernel Team,
I noticed that CVE-2026-80725 is currently vulnerable in Debian Bookworm
(6.1.x), although it has been fixed in Sid and upstream.
I have prepared and tested a backport of the upstream fix (commit
81be30c1f5f2bffda1f04c0efd0746af10b9643a) for the 6.1 kernel tree.
---
From: Alice Mikityanska <[email protected]>
Date: Thu, 5 Feb 2026 15:39:16 +0200
Subject: net/ipv6: Drop HBH for BIG TCP on RX side
Origin: upstream,
https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-80725
Description: Complementary to the previous commit, stop inserting HBH when
building
BIG TCP GRO SKBs.
[ Daniel Pereira ] Backported to 6.1 by removing memmove in ip6_offload.c
and adjusting iph->payload_len logic to match 6.1 context.
Index: linux-6.1.176/net/core/gro.c
===================================================================
--- linux-6.1.176.orig/net/core/gro.c
+++ linux-6.1.176/net/core/gro.c
@@ -182,7 +182,6 @@ int skb_gro_receive(struct sk_buff *p, s
if (unlikely(p->len + len >= GRO_LEGACY_MAX_SIZE)) {
if (p->protocol != htons(ETH_P_IPV6) ||
- skb_headroom(p) < sizeof(struct hop_jumbo_hdr) ||
ipv6_hdr(p)->nexthdr != IPPROTO_TCP ||
p->encapsulation)
return -E2BIG;
Index: linux-6.1.176/net/ipv6/ip6_offload.c
===================================================================
--- linux-6.1.176.orig/net/ipv6/ip6_offload.c
+++ linux-6.1.176/net/ipv6/ip6_offload.c
@@ -350,34 +350,8 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_com
skb_set_inner_network_header(skb, nhoff);
}
- payload_len = skb->len - nhoff - sizeof(*iph);
- if (unlikely(payload_len > IPV6_MAXPLEN)) {
- struct hop_jumbo_hdr *hop_jumbo;
- int hoplen = sizeof(*hop_jumbo);
-
- /* Move network header left */
- memmove(skb_mac_header(skb) - hoplen, skb_mac_header(skb),
- skb->transport_header - skb->mac_header);
- skb->data -= hoplen;
- skb->len += hoplen;
- skb->mac_header -= hoplen;
- skb->network_header -= hoplen;
- iph = (struct ipv6hdr *)(skb->data + nhoff);
- hop_jumbo = (struct hop_jumbo_hdr *)(iph + 1);
-
- /* Build hop-by-hop options */
- hop_jumbo->nexthdr = iph->nexthdr;
- hop_jumbo->hdrlen = 0;
- hop_jumbo->tlv_type = IPV6_TLV_JUMBO;
- hop_jumbo->tlv_len = 4;
- hop_jumbo->jumbo_payload_len = htonl(payload_len + hoplen);
-
- iph->nexthdr = NEXTHDR_HOP;
- iph->payload_len = 0;
- } else {
- iph = (struct ipv6hdr *)(skb->data + nhoff);
- iph->payload_len = htons(payload_len);
- }
+ iph = (struct ipv6hdr *)(skb->data + nhoff);
+ iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops);
if (WARN_ON(!ops || !ops->callbacks.gro_complete))
--- End Message ---
--- Begin Message ---
Hi
On Sat, Aug 29, 2026 at 06:14:45PM -0300, Daniel Pereira wrote:
> Package: src:linux
> Version: 6.1.180-1
> Severity: important
> Tags: patch security
>
> Dear Debian Kernel Team,
>
> I noticed that CVE-2026-80725 is currently vulnerable in Debian
> Bookworm (6.1.x), although it has been fixed in Sid and upstream.
> I have prepared and tested a backport of the upstream fix (commit
> 81be30c1f5f2bffda1f04c0efd0746af10b9643a) for the 6.1 kernel tree.
Please do not fill bugs for CVEs in src:linux unless there is really
need to, that just adds unnecessary overhead. In this case even the
commit has already been backported upstream in 6.1.185 and is pending
in the next upload.
FWIW, when a backport is missing in a specific upstream stable series
and you have mad a backport, submit it to the upstream stable list for
inclusion and then it can be picked up in Debian as well.
Regards,
Salvatore
--- End Message ---
