[ciqcbr7_9] Multiple patches tested (2 commits) by ciq-kernel-automation[bot] · Pull Request #1718 · ctrliq/kernel-src-tree

ciq-kernel-automation · 2026-10-19T16:54:47Z

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

netfilter: nfnetlink_queue: unbreak SCTP traffic

jira VULN-221091
cve-pre CVE-2026-99999
commit-author Antonio Ojea <aojea@google.com>
commit 26a77d02891ab62172085a4f94af9b3c90aed387
upstream-diff |
    context diff: this kernel predates the nfnetlink_queue refactor;
    the file is net/netfilter/nfnetlink_queue_core.c here. The commit
    depends on two inline helpers added to include/linux/skbuff.h by
    later upstream commits (skb_is_gso_sctp in d02f51cbcf12b0,
    skb_csum_is_sctp in fa82117010430); both are folded into this
    backport at upstream-adjacent placements, as the remaining hunks
    of those commits (BPF filter.c proto-xlat, documentation,
    ionic driver) do not apply to this kernel. skb_crc32c_csum_help()
    already exists in net/core/dev.c in this kernel (unexported);
    only its EXPORT_SYMBOL is added. In nfnetlink_queue_core.c the
    helper insertion conflicted against functions absent in this
    kernel (nfqnl_put_sk_uidgid &c.) and is placed directly above
    nfqnl_build_packet_message; the COPY_PACKET and enqueue-condition
    hunks apply at their original call sites.

ipv4: validate checksum_start before completing checksum

jira VULN-221091
cve CVE-2026-99999
commit-author Michael S. Tsirkin <mst@redhat.com>
commit 6785011f8b16abf40b1e9d8b2e332232b3e68822
commit-source-sha a464d950f31c89565cbaae038cc60db04fe01956
commit-source linux-5.10.y
upstream-diff |
    context diff: net/bridge/netfilter/nf_conntrack_bridge.c does not
    exist in this kernel (added in 4.19) and is dropped; bridge
    fragmentation on this tree goes via net/bridge/br_netfilter_hooks.c
    -> ip_do_fragment() which is already covered by the central
    ip_do_fragment fix above, so no standalone bridge helper needs
    patching. nfnetlink_queue is nfnetlink_queue_core.c here;
    nf_queue_checksum_help() was added by the cve-pre 26a77d02891ab
    backport earlier in this branch, so the ip validation hunk lands
    at the top of that function exactly as upstream. xt_CHECKSUM keeps
    this kernel's existing condition (the skb_is_gso skip upstream
    gained is a separate commit, not part of this fix) and adds only
    the NFPROTO_IPV4 guard. xfrm_output keeps this kernel's 2-arg
    xfrm_output2(sk, skb) signature; the error path is a new error:
    label without upstream's out: label, and upstream's trailing
    xfrm4_tunnel_check_size context does not exist in this kernel.

Test Results

✅ Build Stage

Status: Passed (x86_64)
Build Time: 12m 23s
Total Time: 13m 33s
View build logs

✅ Boot Verification

Status: Passed (x86_64)
View boot logs

🤖 This PR was automatically generated by GitHub Actions
Run ID: 39428516922

jira VULN-221091 cve-pre CVE-2026-99999 commit-author Antonio Ojea <aojea@google.com> commit 26a77d0 upstream-diff | context diff: this kernel predates the nfnetlink_queue refactor; the file is net/netfilter/nfnetlink_queue_core.c here. The commit depends on two inline helpers added to include/linux/skbuff.h by later upstream commits (skb_is_gso_sctp in d02f51c, skb_csum_is_sctp in fa82117); both are folded into this backport at upstream-adjacent placements, as the remaining hunks of those commits (BPF filter.c proto-xlat, documentation, ionic driver) do not apply to this kernel. skb_crc32c_csum_help() already exists in net/core/dev.c in this kernel (unexported); only its EXPORT_SYMBOL is added. In nfnetlink_queue_core.c the helper insertion conflicted against functions absent in this kernel (nfqnl_put_sk_uidgid &c.) and is placed directly above nfqnl_build_packet_message; the COPY_PACKET and enqueue-condition hunks apply at their original call sites. when packet is enqueued with nfqueue and GSO is enabled, checksum calculation has to take into account the protocol, as SCTP uses a 32 bits CRC checksum. Enter skb_gso_segment() path in case of SCTP GSO packets because skb_zerocopy() does not support for GSO_BY_FRAGS. Joint work with Pablo. Signed-off-by: Antonio Ojea <aojea@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> (cherry picked from commit 26a77d0) Signed-off-by: Jonathan Maple <jmaple@ciq.com> Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>

github-actions · 2026-10-19T17:05:14Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/39291088686

github-actions · 2026-10-19T17:05:14Z

🔍 Diffofdiffs: All 2 backports differ from upstream

View the diffofdiffs report.

Open to anyone signed in to GitHub. Report expires 2027-01-17 16:54 UTC.

#	Subject	Backport	Upstream
1	`netfilter: nfnetlink_queue: unbreak SCTP traffic`	`6516ea705dd3`	`26a77d02891a`
2	`ipv4: validate checksum_start before completing checksum`	`0230e8f8bc61`	`6785011f8b16`

Checked PR revision 0230e8f8bc61 against base afc12fa6f3c1.

github-actions · 2026-10-19T17:06:13Z

JIRA PR Check Results

2 commit(s) with issues found:

Commit `0230e8f8bc61`

Summary: ipv4: validate checksum_start before completing checksum

⚠️ Warnings:

VULN-221091: No time logged - please log time manually

Commit `6516ea705dd3`

Summary: netfilter: nfnetlink_queue: unbreak SCTP traffic

⚠️ Warnings:

VULN-221091: No time logged - please log time manually

Summary: Checked 2 commit(s) total.

github-actions · 2026-10-19T17:06:14Z

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/39291088686

kerneltoast

Just the extra newline to remove. Everything else looks correct to me.

jira VULN-221091 cve CVE-2026-99999 commit-author Michael S. Tsirkin <mst@redhat.com> commit 6785011 commit-source-sha a464d950f31c89565cbaae038cc60db04fe01956 commit-source linux-5.10.y upstream-diff | context diff: net/bridge/netfilter/nf_conntrack_bridge.c does not exist in this kernel (added in 4.19) and is dropped; bridge fragmentation on this tree goes via net/bridge/br_netfilter_hooks.c -> ip_do_fragment() which is already covered by the central ip_do_fragment fix above, so no standalone bridge helper needs patching. nfnetlink_queue is nfnetlink_queue_core.c here; nf_queue_checksum_help() was added by the cve-pre 26a77d0 backport earlier in this branch, so the ip validation hunk lands at the top of that function exactly as upstream. xt_CHECKSUM keeps this kernel's existing condition (the skb_is_gso skip upstream gained is a separate commit, not part of this fix) and adds only the NFPROTO_IPV4 guard. xfrm_output keeps this kernel's 2-arg xfrm_output2(sk, skb) signature; the error path is a new error: label without upstream's out: label, and upstream's trailing xfrm4_tunnel_check_size context does not exist in this kernel. commit 6785011 upstream. If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. Cc: stable@vger.kernel.org Fixes: f43798c ("tun: Allow GSO using virtio_net_hdr") Fixes: bfd5f4a ("packet: Add GSO/csum offload support.") Reported-by: Paulos Yibelo <habte.yibelo@gmail.com> Closes: https://lore.kernel.org/netdev/20260922030310.8684-2-habte.yibelo@gmail.com/ Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/0a012b4923e189c4c593ef4f471e5ff0edbe9030.1791412497.git.mst@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit a464d950f31c89565cbaae038cc60db04fe01956) Signed-off-by: Jonathan Maple <jmaple@ciq.com> Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>

github-actions · 2026-10-20T13:23:31Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/39429958763

github-actions · 2026-10-20T13:23:31Z

🔍 Diffofdiffs: All 2 backports differ from upstream

View the diffofdiffs report.

Open to anyone signed in to GitHub. Report expires 2027-01-18 13:12 UTC.

#	Subject	Backport	Upstream
1	`netfilter: nfnetlink_queue: unbreak SCTP traffic`	`6516ea705dd3`	`26a77d02891a`
2	`ipv4: validate checksum_start before completing checksum`	`9d39c2c26cfe`	`6785011f8b16`

Checked PR revision 9d39c2c26cfe against base afc12fa6f3c1.

github-actions · 2026-10-20T13:24:26Z

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/39429958763

kerneltoast

PlaidCat

ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Oct 19, 2026

PlaidCat assigned bmastbergen Oct 19, 2026

PlaidCat requested a review from a team October 19, 2026 17:56

kerneltoast requested changes Oct 19, 2026

View reviewed changes

Comment thread net/xfrm/xfrm_output.c Outdated

bmastbergen force-pushed the {bmastbergen_cve-2026-99999}_ciqcbr7_9 branch from 0230e8f to 9d39c2c Compare October 20, 2026 13:12

bmastbergen requested review from a team and kerneltoast October 20, 2026 13:12

kerneltoast approved these changes Oct 20, 2026

View reviewed changes

PlaidCat approved these changes Oct 20, 2026

View reviewed changes

bmastbergen merged commit b150cdd into ciqcbr7_9 Oct 20, 2026
4 of 5 checks passed

bmastbergen deleted the {bmastbergen_cve-2026-99999}_ciqcbr7_9 branch October 20, 2026 17:38

Navigation Menu

Repository navigation

[ciqcbr7_9] Multiple patches tested (2 commits) - #1718

[ciqcbr7_9] Multiple patches tested (2 commits)#1718
bmastbergen merged 2 commits into
ciqcbr7_9from
{bmastbergen_cve-2026-99999}_ciqcbr7_9

ciq-kernel-automation Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

kerneltoast left a comment

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

kerneltoast left a comment

Uh oh!

PlaidCat left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

ciq-kernel-automation Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Commit Message(s)

Test Results

✅ Build Stage

✅ Boot Verification

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

github-actions Bot commented Oct 19, 2026

🔍 Diffofdiffs: All 2 backports differ from upstream

Uh oh!

github-actions Bot commented Oct 19, 2026

JIRA PR Check Results

Commit 0230e8f8bc61

Commit 6516ea705dd3

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

kerneltoast left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

github-actions Bot commented Oct 20, 2026

🔍 Diffofdiffs: All 2 backports differ from upstream

Uh oh!

github-actions Bot commented Oct 20, 2026

Uh oh!

kerneltoast left a comment

Choose a reason for hiding this comment

Uh oh!

PlaidCat left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

ciq-kernel-automation Bot commented Oct 19, 2026 •

edited

Loading

Commit `0230e8f8bc61`

Commit `6516ea705dd3`