• changed/a10/kernel-6.12.0-124.56.2.el10_1 c3f0a68cfa

    alukoshko released this 2026-05-13 13:19:44 +00:00 | -2 commits to c8 since this release

    net: skbuff: propagate shared-frag marker through pskb_copy()

    Sibling fix to upstream commit f4c50a4034e6 ("xfrm: esp: avoid
    in-place decrypt on shared skb frags") which is already part of the
    124.56.1 rebase. __pskb_copy_fclone() and skb_try_coalesce()
    shallow-copied frag descriptors without propagating SKBFL_SHARED_FRAG,
    so destinations referencing externally-owned pages reported
    skb_has_shared_frag() as false. Combined with an nft 'dup to '
    rule (or any other nf_dup_ipv4 / xt_TEE caller), this lets an
    unprivileged user write into the page cache of a root-owned read-only
    file via ESP-input in-place decryption.

    Backport of https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/

    Downloads