CVE-2026-99191: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
In the Linux kernel, the following vulnerability has been resolved:
calipso: keep BIG TCP payloadlen in calipsoskbuffsetattr()
calipsoskbuffsetattr() adjusts payloadlen by the length of the option it inserts or resizes:
payload = ntohs(ip6hdr->payloadlen); ip6hdr->payloadlen = htons(payload + lendelta);
GRO can build BIG TCP packets larger than IPV6MAXPLEN, and stores payloadlen == 0 for them; ipv6payloadlen() then falls back to skb->len. For such a packet forwarded to a destination mapped to CALIPSO, the code above writes lendelta (or 65536 + lendelta when shrinking) into payloadlen, and ipv6payloadlen() no longer falls back to skb->len. nftables, conntrack and schcake rely on it.
The same arithmetic also wraps when a packet grows past IPV6MAXPLEN, and a BIG TCP packet that shrinks below IPV6MAXPLEN should get its real length back.
Set payloadlen from the skb length with ipv6setpayloadlen(), which stores 0 above IPV6MAXPLEN and the real length otherwise, as ipv6grocomplete() does. The network header was just reset to skb->data, so skb->len - sizeof(ip6hdr) is the payload length.
Tested on one kernel (arm64, QEMU) with SELinux permissive, a minimal mdp-generated policy (networkpeercontrols=1), "netlabelctl calipso add pass doi:16" and a NetLabel mapping of fd00:2::/64 to CALIPSO DOI 16. calipsoskbuffsetattr() was called through netlblskbuffsetattr() from a test-only debugfs hook (not part of this patch) adding a level-only label; payloadlen after the call:
case before fix after fix real length 1000, unlabeled 1016 1016 1016 70000 GSO, payloadlen 0 16 0 70016 65530 GSO, grows past MAXPLEN 10 0 65546 65540 GSO with a 24 byte hop header, shrinks below MAXPLEN 65528 65532 65532 1000 with a 24 byte hop header 992 992 992
(0 means ipv6payloadlen() returns the real length.) On the forward path, with a client injecting unlabeled UDP through a router to a server, the router adds the CALIPSO option and the server delivers all datagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.