CVE-2026-98401: net: iptunnel: fix stale transport header during tunnel decapsulation

In the Linux kernel, the following vulnerability has been resolved:

net: iptunnel: fix stale transport header during tunnel decapsulation

Syzbot reported a crash in qdiscpktlensegsinit() caused by a stale transportheader offset after tunnel decapsulation.

BUG: unable to handle page fault for address: ffffed102091a42e Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 340 Comm: qdiscuafrepro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:asanload2 <IRQ> qdiscpktlensegsinit (net/core/dev.c:4145) devqueuexmit (net/core/dev.c:4787) brdevqueuepushxmit (net/bridge/brforward.c:53) brhandleframefinish (net/bridge/brinput.c:229) brhandleframe (net/bridge/brinput.c:315) netifreceiveskbcore.constprop.0 (net/core/dev.c:6099) netifreceiveskblistcore (net/core/dev.c:6287) netifreceiveskblistinternal (net/core/dev.c:6445) napicompletedone (net/core/dev.c:6813) grocellpoll (net/core/grocells.c:74) napipoll (net/core/dev.c:7735) netrxaction (net/core/dev.c:7798 net/core/dev.c:7955) handlesoftirqs (kernel/softirq.c:622) dosoftirq (kernel/softirq.c:523 kernel/softirq.c:510 ) localbhenableip (kernel/softirq.c:450) tungetuser (drivers/net/tun.c:1986 (discriminator 1)) tunchrwriteiter (drivers/net/tun.c:2032)

The issue is completely latent until qdisc read transport header in commit 7fb4c1967011 ("net: pull headers in qdiscpktlensegsinit()"). The crash requires four conditions to line up:

1. The incoming packet is encapsulated and carries GSO metadata. The outer transport header offset is stored in skb->transportheader while the packet is still in the outer tunnel context. 2. The tunnel receiver strips the outer headers. skb->data is advanced to the inner frame, but skb->transportheader is left pointing to the now-removed outer L4 header, so it becomes a negative offset relative to the new data. 3. The inner frame is not delivered to the local IP stack. Instead, it is forwarded at L2 by a bridge or HSR, so iprcvcore() never runs and the transport header is not reset to the inner L4 offset. 4. The forwarding path calls devqueuexmit(), which enters qdiscpktlensegsinit(). That function computes the GSO header length from skbtransportoffset(skb). Because the offset is negative, the unsigned cast overflows and pskbmaypull(skb, hdrlen + sizeof(struct tcphdr)) reads past the end of the skb, triggering a KASAN fault or page fault.

The issue specifically requires GSO packets (shinfo->gsosize != 0), which are processed/aggregated through grocells. Fix this by clearing transportheader to the ~0U sentinel in grocell for all tunnnel driver. GTP does not support GRO/GSO, drop the evil GSO packets in GTP directly.