Dear Debian Kernel Team,
I noticed that CVE-2026-80725 is currently vulnerable in Debian Bookworm (6.1.x), although it has been fixed in Sid and upstream.
I have prepared and tested a backport of the upstream fix (commit 81be30c1f5f2bffda1f04c0efd0746af10b9643a) for the 6.1 kernel tree.
---
From: Alice Mikityanska <alice@isovalent.com>
Date: Thu, 5 Feb 2026 15:39:16 +0200
Subject: net/ipv6: Drop HBH for BIG TCP on RX side
Origin: upstream, https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-80725
Description: Complementary to the previous commit, stop inserting HBH when building
BIG TCP GRO SKBs.
[ Daniel Pereira ] Backported to 6.1 by removing memmove in ip6_offload.c
and adjusting iph->payload_len logic to match 6.1 context.
Index: linux-6.1.176/net/core/gro.c
===================================================================
--- linux-6.1.176.orig/net/core/gro.c
+++ linux-6.1.176/net/core/gro.c
@@ -182,7 +182,6 @@ int skb_gro_receive(struct sk_buff *p, s
if (unlikely(p->len + len >= GRO_LEGACY_MAX_SIZE)) {
if (p->protocol != htons(ETH_P_IPV6) ||
- skb_headroom(p) < sizeof(struct hop_jumbo_hdr) ||
ipv6_hdr(p)->nexthdr != IPPROTO_TCP ||
p->encapsulation)
return -E2BIG;
Index: linux-6.1.176/net/ipv6/ip6_offload.c
===================================================================
--- linux-6.1.176.orig/net/ipv6/ip6_offload.c
+++ linux-6.1.176/net/ipv6/ip6_offload.c
@@ -350,34 +350,8 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_com
skb_set_inner_network_header(skb, nhoff);
}
- payload_len = skb->len - nhoff - sizeof(*iph);
- if (unlikely(payload_len > IPV6_MAXPLEN)) {
- struct hop_jumbo_hdr *hop_jumbo;
- int hoplen = sizeof(*hop_jumbo);
-
- /* Move network header left */
- memmove(skb_mac_header(skb) - hoplen, skb_mac_header(skb),
- skb->transport_header - skb->mac_header);
- skb->data -= hoplen;
- skb->len += hoplen;
- skb->mac_header -= hoplen;
- skb->network_header -= hoplen;
- iph = (struct ipv6hdr *)(skb->data + nhoff);
- hop_jumbo = (struct hop_jumbo_hdr *)(iph + 1);
-
- /* Build hop-by-hop options */
- hop_jumbo->nexthdr = iph->nexthdr;
- hop_jumbo->hdrlen = 0;
- hop_jumbo->tlv_type = IPV6_TLV_JUMBO;
- hop_jumbo->tlv_len = 4;
- hop_jumbo->jumbo_payload_len = htonl(payload_len + hoplen);
-
- iph->nexthdr = NEXTHDR_HOP;
- iph->payload_len = 0;
- } else {
- iph = (struct ipv6hdr *)(skb->data + nhoff);
- iph->payload_len = htons(payload_len);
- }
+ iph = (struct ipv6hdr *)(skb->data + nhoff);
+ iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops);
if (WARN_ON(!ops || !ops->callbacks.gro_complete))
Dear Debian Kernel Team,
I noticed that CVE-2026-80725 is currently vulnerable in Debian Bookworm (6.1.x), although it has been fixed in Sid and upstream.
I have prepared and tested a backport of the upstream fix (commit 81be30c1f5f2bffda1f04c0efd0746af10b9643a) for the 6.1 kernel tree.
---
Changes in v2:
- Removed unused 'payload_len' variable in ipv6_gro_complete to fix -Werror build failure.
From: Alice Mikityanska <alice@isovalent.com>
Date: Thu, 5 Feb 2026 15:39:16 +0200
Subject: net/ipv6: Drop HBH for BIG TCP on RX side
Origin: upstream, https://git.kernel.org/linus/81be30c1f5f2bffda1f04c0efd0746af10b9643a
Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2026-80725
Description: Complementary to the previous commit, stop inserting HBH when building
BIG TCP GRO SKBs.
[ Daniel Pereira ] Backported to 6.1 by removing memmove in ip6_offload.c
and adjusting iph->payload_len logic to match 6.1 context.
Index: linux-6.1.176/net/core/gro.c
===================================================================
--- linux-6.1.176.orig/net/core/gro.c
+++ linux-6.1.176/net/core/gro.c
@@ -182,7 +182,6 @@ int skb_gro_receive(struct sk_buff *p, s
if (unlikely(p->len + len >= GRO_LEGACY_MAX_SIZE)) {
if (p->protocol != htons(ETH_P_IPV6) ||
- skb_headroom(p) < sizeof(struct hop_jumbo_hdr) ||
ipv6_hdr(p)->nexthdr != IPPROTO_TCP ||
p->encapsulation)
return -E2BIG;
Index: linux-6.1.176/net/ipv6/ip6_offload.c
===================================================================
--- linux-6.1.176.orig/net/ipv6/ip6_offload.c
+++ linux-6.1.176/net/ipv6/ip6_offload.c
@@ -344,40 +344,13 @@ INDIRECT_CALLABLE_SCOPE int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
{
const struct net_offload *ops;
struct ipv6hdr *iph;
int err = -ENOSYS;
- u32 payload_len;
if (skb->encapsulation) {
skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IPV6));
skb_set_inner_network_header(skb, nhoff);
}
- payload_len = skb->len - nhoff - sizeof(*iph);
- if (unlikely(payload_len > IPV6_MAXPLEN)) {
- struct hop_jumbo_hdr *hop_jumbo;
- int hoplen = sizeof(*hop_jumbo);
-
- /* Move network header left */
- memmove(skb_mac_header(skb) - hoplen, skb_mac_header(skb),
- skb->transport_header - skb->mac_header);
- skb->data -= hoplen;
- skb->len += hoplen;
- skb->mac_header -= hoplen;
- skb->network_header -= hoplen;
- iph = (struct ipv6hdr *)(skb->data + nhoff);
- hop_jumbo = (struct hop_jumbo_hdr *)(iph + 1);
-
- /* Build hop-by-hop options */
- hop_jumbo->nexthdr = iph->nexthdr;
- hop_jumbo->hdrlen = 0;
- hop_jumbo->tlv_type = IPV6_TLV_JUMBO;
- hop_jumbo->tlv_len = 4;
- hop_jumbo->jumbo_payload_len = htonl(payload_len + hoplen);
-
- iph->nexthdr = NEXTHDR_HOP;
- iph->payload_len = 0;
- } else {
- iph = (struct ipv6hdr *)(skb->data + nhoff);
- iph->payload_len = htons(payload_len);
- }
+ iph = (struct ipv6hdr *)(skb->data + nhoff);
+ iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops);
if (WARN_ON(!ops || !ops->callbacks.gro_complete))
Hi Please do not fill bugs for CVEs in src:linux unless there is really need to, that just adds unnecessary overhead. In this case even the commit has already been backported upstream in 6.1.185 and is pending in the next upload. FWIW, when a backport is missing in a specific upstream stable series and you have mad a backport, submit it to the upstream stable list for inclusion and then it can be picked up in Debian as well. Regards, Salvatore