{"schema":"threatline.record/2","record":{"id":"CVE-2026-99191","aliases":[],"summary":"calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: keep BIG TCP payload_len in calipso_skbuff_setattr()\n\ncalipso_skbuff_setattr() adjusts payload_len by the length of the\noption it inserts or resizes:\n\n\tpayload = ntohs(ip6_hdr->payload_len);\n\tip6_hdr->payload_len = htons(payload + len_delta);\n\nGRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores\npayload_len == 0 for them; ipv6_payload_len() then falls back to\nskb->len.  For such a packet forwarded to a destination mapped to\nCALIPSO, the code above writes len_delta (or 65536 + len_delta when\nshrinking) into payload_len, and ipv6_payload_len() no longer falls\nback to skb->len.  nf_tables, conntrack and sch_cake rely on it.\n\nThe same arithmetic also wraps when a packet grows past IPV6_MAXPLEN,\nand a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its\nreal length back.\n\nSet payload_len from the skb length with ipv6_set_payload_len(), which\nstores 0 above IPV6_MAXPLEN and the real length otherwise, as\nipv6_gro_complete() does.  The network header was just reset to\nskb->data, so skb->len - sizeof(*ip6_hdr) is the payload length.\n\nTested on one kernel (arm64, QEMU) with SELinux permissive, a minimal\nmdp-generated policy (network_peer_controls=1), \"netlabelctl calipso\nadd pass doi:16\" and a NetLabel mapping of fd00:2::/64 to CALIPSO\nDOI 16.  calipso_skbuff_setattr() was called through\nnetlbl_skbuff_setattr() from a test-only debugfs hook (not part of\nthis patch) adding a level-only label; payload_len after the call:\n\n  case                         before fix   after fix   real length\n  1000, unlabeled                    1016        1016          1016\n  70000 GSO, payload_len 0             16           0         70016\n  65530 GSO, grows past MAXPLEN        10           0         65546\n  65540 GSO with a 24 byte hop\n  header, shrinks below MAXPLEN     65528       65532         65532\n  1000 with a 24 byte hop header      992         992           992\n\n(0 means ipv6_payload_len() returns the real length.)  On the forward\npath, with a client injecting unlabeled UDP through a router to a\nserver, the router adds the CALIPSO option and the server delivers all\ndatagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_modified_at":"2026-10-28T10:35:47.854Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"Linux","vendor":"Linux","versions":[{"version":"81fbc812132cbc72a0f933b19bfd3a829bd946e4","lessThan":"1c9fcfca51e3c5cd46dd72a4da74d56eff183513","status":"affected","versionType":"git"},{"version":"81fbc812132cbc72a0f933b19bfd3a829bd946e4","lessThan":"8ee0e03663826a76507048d58466b29321a57656","status":"affected","versionType":"git"},{"version":"81fbc812132cbc72a0f933b19bfd3a829bd946e4","lessThan":"8070ed578b6b9134e045627fb745c887a806d46e","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_modified_at":"2026-10-28T10:35:47.854Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","status":"unaffected","versionType":"semver"},{"version":"6.18.59","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.13","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_modified_at":"2026-10-28T10:35:47.854Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"Linux","ecosystem":null},"version":"1c9fcfca51e3c5cd46dd72a4da74d56eff183513","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_modified_at":"2026-10-28T10:35:47.854Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"Linux","ecosystem":null},"version":"8ee0e03663826a76507048d58466b29321a57656","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","source_modified_at":"2026-10-28T10:35:47.854Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"Linux","ecosystem":null},"version":"8070ed578b6b9134e045627fb745c887a806d46e","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T10:35:47.854Z","modified_at":"2026-10-28T10:35:47.854Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-99191","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T10:35:47.854Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/1c9fcfca51e3c5cd46dd72a4da74d56eff183513"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8ee0e03663826a76507048d58466b29321a57656"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T10:35:47.854Z","content_hash":"a5b778cd8d3f3da9aa98ab8e13b60079c151ab515e470016fbe2f7a174165642"}}