Re: [PATCH net v2] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

[email protected] Fri, 17 Jul 2026 09:30:20 +0000

Newsgroups	gmane.linux.network,gmane.comp.security.firewalls.netfilter.devel,gmane.linux.kernel,gmane.linux.kernel.stable
Message-ID	<178428062039.1629459.13884661779658257379.git-patchwork-notify@kernel.org>

Hello:

This patch was applied to netdev/net.git (main)
by Florian Westphal <[email protected]>:

On Wed,  8 Jul 2026 18:11:50 +0000 you wrote:
> br_ip6_fragment() gets prevhdr, a pointer into the skb head, from
> ip6_find_1stfragopt(), then calls skb_checksum_help().  For a cloned skb
> skb_checksum_help() reallocates the head via pskb_expand_head(), leaving
> prevhdr dangling.  It is later dereferenced in ip6_frag_next(), causing a
> use-after-free write.
> 
> Save prevhdr's offset before skb_checksum_help() and recompute it after,
> like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6
> fragment").
> 
> [...]

Here is the summary with links:
  - [net,v2] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
    https://git.kernel.org/netdev/net/c/86f3ce81dd2b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html