{"id":"AZL-111356","summary":"CVE-2026-99191 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: keep BIG TCP payload_len in calipso_skbuff_setattr()\n\ncalipso_skbuff_setattr() adjusts payload_len by the length of the\noption it inserts or resizes:\n\n\tpayload = ntohs(ip6_hdr-\u003epayload_len);\n\tip6_hdr-\u003epayload_len = htons(payload + len_delta);\n\nGRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores\npayload_len == 0 for them; ipv6_payload_len() then falls back to\nskb-\u003elen.  For such a packet forwarded to a destination mapped to\nCALIPSO, the code above writes len_delta (or 65536 + len_delta when\nshrinking) into payload_len, and ipv6_payload_len() no longer falls\nback to skb-\u003elen.  nf_tables, conntrack and sch_cake rely on it.\n\nThe same arithmetic also wraps when a packet grows past IPV6_MAXPLEN,\nand a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its\nreal length back.\n\nSet payload_len from the skb length with ipv6_set_payload_len(), which\nstores 0 above IPV6_MAXPLEN and the real length otherwise, as\nipv6_gro_complete() does.  The network header was just reset to\nskb-\u003edata, so skb-\u003elen - sizeof(*ip6_hdr) is the payload length.\n\nTested on one kernel (arm64, QEMU) with SELinux permissive, a minimal\nmdp-generated policy (network_peer_controls=1), \"netlabelctl calipso\nadd pass doi:16\" and a NetLabel mapping of fd00:2::/64 to CALIPSO\nDOI 16.  calipso_skbuff_setattr() was called through\nnetlbl_skbuff_setattr() from a test-only debugfs hook (not part of\nthis patch) adding a level-only label; payload_len after the call:\n\n  case                         before fix   after fix   real length\n  1000, unlabeled                    1016        1016          1016\n  70000 GSO, payload_len 0             16           0         70016\n  65530 GSO, grows past MAXPLEN        10           0         65546\n  65540 GSO with a 24 byte hop\n  header, shrinks below MAXPLEN     65528       65532         65532\n  1000 with a 24 byte hop header      992         992           992\n\n(0 means ipv6_payload_len() returns the real length.)  On the forward\npath, with a client injecting unlabeled UDP through a router to a\nserver, the router adds the CALIPSO option and the server delivers all\ndatagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.","modified":"2026-10-30T05:35:37Z","published":"2026-10-28T11:17:40Z","upstream":["CVE-2026-99191"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99191"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111356.json"}}],"schema_version":"1.9.2"}