Re: [BUG] net/sched: act_csum can checksum beyond a short IPv6 jumbogram skb

[Andrew Lunn]

On Thu, Oct 22, 2026 at 02:46:53PM +0000, shaos wrote:
> Hello,
> 
> An unprivileged process with namespace-scoped CAP_NET_ADMIN and CAP_NET_RAW installs a csum action for UDP-Lite and sends a 300-byte IPv6 frame with a Jumbo Payload value of 0xffffffca and UDP-Lite coverage longer than the bytes present. The jumbo-length addition wraps the pull-length check, while the later checksum path still uses the unwrapped length.

Please configure your editor to wrap lines at around 70
characters. Standard netiquette rules should be used on mailing lists.

Flooding the netdev list with bug reports like this will just result
in them being directed to /dev/null.

If you want to do something useful, fix the issue. Please do it
slowly, one bug report at a time, so you can learn how to do it
correctly without wasting peoples time.

   Andrew