CVE-2026-31517: xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: fix skbput() panic on non-linear skb during reassembly

In iptfsreassemcont(), IP-TFS attempts to append data to the new inner packet 'newskb' that is being reassembled. First a zero-copy approach is tried if it succeeds then newskb becomes non-linear.

When a subsequent fragment in the same datagram does not meet the fast-path conditions, a memory copy is performed. It calls skbput() to append the data and as newskb is non-linear it triggers SKBLINEARASSERT check.

Oops: invalid opcode: 0000 [#1] SMP NOPTI [...] RIP: 0010:skbput+0x3c/0x40 [...] Call Trace: <IRQ> iptfsreassemcont+0x1ab/0x5e0 [xfrmiptfs] iptfsinputordered+0x2af/0x380 [xfrmiptfs] iptfsinput+0x122/0x3e0 [xfrmiptfs] xfrminput+0x91e/0x1a50 xfrm4esprcv+0x3a/0x110 ipprotocoldeliverrcu+0x1d7/0x1f0 iplocaldeliverfinish+0xbe/0x1e0 netifreceiveskbcore.constprop.0+0xb56/0x1120 netifreceiveskblistcore+0x133/0x2b0 netifreceiveskblistinternal+0x1ff/0x3f0 napicompletedone+0x81/0x220 virtnetpoll+0x9d6/0x116e [virtionet] napipoll.constprop.0+0x2b/0x270 netrxaction+0x162/0x360 handlesoftirqs+0xdc/0x510 irqexitrcu+0xe7/0x110 irqexitrcu+0xe/0x20 commoninterrupt+0x85/0xa0 </IRQ> <TASK>

Fix this by checking if the skb is non-linear. If it is, linearize it by calling skblinearize(). As the initial allocation of newskb originally reserved enough tailroom for the entire reassembled packet we do not need to check if we have enough tailroom or extend it.