Executive brief
A vulnerability was identified in the Linux kernel's IPv4 networking component. This issue involves incorrect memory allocation calculations when handling fragmented network data. If exploited, it could lead to system instability or memory corruption, potentially impacting the reliability of servers and network services.
Technical details
A vulnerability exists in the Linux kernel's IPv4 stack within the `__ip_append_data()` function. When the paged-allocation path is utilized, the kernel fails to properly account for 'fraggap' (fragmentation gap) bytes carried over from previous socket buffers (skbs). Specifically, `alloclen` is calculated without including `fraggap`, while `pagedlen` is overstated. This results in the linear area of the new skb being undersized when `skb_copy_and_csum_bits()` attempts to copy data, leading to a potential buffer overflow or memory corruption. The fix adjusts the calculation by adding `fraggap` to `alloclen` and subtracting it from `pagedlen` to ensure correct buffer sizing.
Affected products
- Linux Linux Kernel 6.0 to 6.6.144, 6.12.95, 6.18.38, 7.1.3
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
References
- https://git.kernel.org/stable/c/77798d7be6ef71e72fb6fc8a2901bf74ebc9706f
- https://git.kernel.org/stable/c/a9c24eda24bd15f432e37824e6fc440977cb241c
- https://git.kernel.org/stable/c/c04d9ece23deb9e26c19f9ca215e98b3295aa1bb
- https://git.kernel.org/stable/c/ce494707a9c07f27c219ca67f3e138061f53d9b3
- https://git.kernel.org/stable/c/eca856950f7cb1a221e02b99d758409f2c5cec42