-
released this
2026-05-13 13:19:44 +00:00 | -2 commits to c8 since this releasenet: skbuff: propagate shared-frag marker through pskb_copy()
Sibling fix to upstream commit f4c50a4034e6 ("xfrm: esp: avoid
in-place decrypt on shared skb frags") which is already part of the
124.56.1 rebase. __pskb_copy_fclone() and skb_try_coalesce()
shallow-copied frag descriptors without propagating SKBFL_SHARED_FRAG,
so destinations referencing externally-owned pages reported
skb_has_shared_frag() as false. Combined with an nft 'dup to '
rule (or any other nf_dup_ipv4 / xt_TEE caller), this lets an
unprivileged user write into the page cache of a root-owned read-only
file via ESP-input in-place decryption.Backport of https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
-
Source code (ZIP)