Daily update · Aug 13–14, 2026
Linux mainline: SCTP LPE and remote UAFs, XDP memory leak, TCP ACK storms, veth GRO stall fixed
Today's mainline updates close a local privilege escalation in SCTP cookie handling, two remotely triggerable SCTP use-after-free bugs, a kernel pointer leak through XDP fragment accounting, and a stack out-of-bounds write in IPVS ICMP tunneling, alongside notable networking stability fixes.
In brief
A security-heavy batch lands in the mainline: SCTP gets cookie validation hardening plus fixes for two authenticated ASCONF use-after-free bugs reachable by remote peers; XDP generic/veth paths stop leaking kernel memory addresses to userspace; IPVS tunnel ICMP rebasing no longer corrupts the kernel stack; and TLS splice no longer delivers plaintext after failed decryption. On the bug-fix side, nf_tables flowtable gains use-after-free protection under flow churn, TCP delayed ACK bitfield overflow that caused ACK storms on cross-region links is corrected, ipvlan/macvlan now inherit lower-device headroom, multi-queue veth GRO no longer stalls, bnxt TPH no longer breaks aRFS or deadlocks, ovpn module unload no longer frees code mid-callback, and the Unix domain socket garbage collector no longer partially frees dead strongly-connected components. Performance work reduces IPVS per-connection atomic ops, and a tracing NULL deref, Mediatek mt7921e/mt7925e hang, FireWire OHCI probe crash, and TI K3 CPSW port_id out-of-bounds access are also fixed.
Security and hardening
SCTP cookie validation closes local privilege escalation
Forged SCTP cookies could inject invalid AUTH parameters, causing out-of-bounds reads and a 32-byte write past a zero-length AUTH chunk that gave a primitive for local privilege escalation. The fix validates RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association.
Why it matters: Closes a local privilege escalation chain for SCTP users via crafted cookies.
Two remotely reachable SCTP ASCONF use-after-free bugs fixed
An authenticated ASCONF chunk from a remote peer could add and remove a transport in the same chunk, leaving a dangling pointer dereferenced when sending a HEARTBEAT. Separately, the cached outstanding ASCONF chunk pointer was not cleared during peer restart teardown, so a delayed authenticated ASCONF-ACK could access and double-free the stale chunk.
Why it matters: Remote attackers able to authenticate SCTP ASCONF chunks could trigger kernel memory corruption; both paths are now closed.
XDP fragment accounting leaked kernel pointer to userspace
Generic XDP and veth left skb->len stale after fragment adjustment, causing __skb_datagram_iter() to copy 1024 bytes past the linear tail into userspace, including nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo. Real packet data was truncated by the same amount.
Why it matters: Malformed or adjusted packets on XDP-enabled paths could leak kernel memory addresses and corrupt delivered data.
IPVS tunnel ICMP rebasing caused stack out-of-bounds write
ip_vs_in_icmp() rebased an skb to the quoted original request but left IPCB(skb)->opt describing the outer IPv4 header; a timestamp option could then make __ip_options_echo() copy a stale length byte into fixed-size stack storage, causing a stack out-of-bounds write in __icmp_send().
Why it matters: A crafted ICMP error routed through IPVS tunneling could corrupt kernel stack memory.
TLS splice delivered plaintext after failed decrypt
tls_sw_splice_read() did not check async_wait.err after a failed async decrypt, so splice kept delivering records on a connection that recvmsg() and read_sock() refused to read, exposing plaintext of unauthenticated records.
Why it matters: TLS users using splice could receive unauthenticated plaintext that normal read paths correctly reject.
cls_bpf rejects device-bound TC programs attached to a different device
A BPF program loaded and offloaded for device A could be attached via cls_bpf with skip_sw to device B; deleting device A then destroyed offload state while still attached to device B, causing a WARN or panic with panic_on_warn=1. The attach is now rejected with -EINVAL when the bound device does not match.
Why it matters: Prevents misuse of device-bound BPF classifier programs that could lead to kernel warnings or panics.
Networking bug fixes
nf_tables flowtable use-after-free on partially installed flows
Publishing the original-direction tuple node first let garbage collection observe and free a flow while flow_offload_add() was still inserting the reply node, triggering KASAN slab-use-after-free in rhashtable and flowtable paths. The fix publishes the reply node first and the original node last.
Why it matters: Systems using hardware or software flow offload could hit memory corruption under flow churn.
TCP delayed ACK bitfield overflow caused ACK storms
icsk_ack.ato was squeezed into 8 bits but writers still bounded it by icsk_rto, which can exceed 255 jiffies; the bitfield silently wrapped mod 256, making ato==0 trigger the 'first data packet' sentinel and turn delayed ACKs into immediate ACKs plus a TC_MAX_QUICKACKS burst on cross-region connections.
Why it matters: Cross-region TCP connections could suffer sudden ACK bursts and degraded throughput.
ipvlan/macvlan did not inherit headroom/tailroom from lower device
ipvlan and macvlan devices inherited hard_header_len but left needed_headroom and needed_tailroom at 0, so upper layers under-reserved space for headers/trailers required by macsec, ipsec, wireguard, tunnels, or veth with RX headroom, causing reallocation overhead, headroom underflows, or KASAN slab-use-after-free crashes.
Why it matters: Users stacking ipvlan/macvlan over devices needing extra headroom could hit crashes or performance regressions.
veth multi-queue GRO path woke wrong peer TX queue
veth_poll() derived the peer TX queue index from rq->xdp_rxq.queue_index, which stays 0 when no XDP program is attached, so in multi-queue GRO setups every NAPI instance woke peer TX queue 0; a full TX queue 1 was never woken and veth has no tx_timeout handler, stalling transmission.
Why it matters: Multi-queue veth users with GRO and no XDP could silently stall under load.
bnxt TPH support broke aRFS and caused IRQ affinity deadlock
Installing the TPH notifier overrode the implicit aRFS rmap notifier, breaking receive flow steering, and unregistering the notifier while holding the netdev instance lock could deadlock since the notifier callback takes the same lock. The fix updates the rmap from the TPH notifier and moves queue restart to an async service task.
Why it matters: bnxt users with TPH enabled lost aRFS and could deadlock when affinity changed.
ovpn module removal could free code while callbacks still running
ovpn work items ran on global system workqueues with no driver-owned drain point, so module exit could free module text while a worker was still executing ovpn code after dropping the final peer reference; the fix adds a module-owned workqueue, flushes it, and runs rcu_barrier before module exit, plus defers crypto freeing to workqueue context where sleeping is allowed.
Why it matters: ovpn users could trigger use-after-free on module unload or during crypto teardown.
Unix domain socket garbage collector could free dead SCC partially
A race between send() and close() left a B->B edge visible to GC while its skb was not yet queued, so GC judged A->B as dead but could not collect B, leaking or corrupting socket state. The fix unlinks the scc_entry in unix_del_edge() to prevent partial collection.
Why it matters: Applications heavily using Unix domain sockets could hit socket leaks or UAF under concurrent send/close.
am65-cpsw-nuss port_id extraction caused out-of-bounds access
The MAC Port ID was extracted from all 16 bits of the RX DMA Source Tag, but only the lower 8 bits are valid; the upper reserved bits carried arbitrary values leading to an invalid port_id and sporadic kernel crashes from out-of-bounds memory access.
Why it matters: Fixes sporadic crashes on TI K3 CPSW Ethernet (e.g., AM654 boards).
Performance
IPVS connection accounting reduces atomic ops via totalconns counter
Replacing the inactconns dest counter with totalconns lets inactconns be derived as totalconns - activeconns, cutting atomic inc/dec ops for TCP/SCTP from 6 to 4 on established+closed connections, and separates destination availability from overload state to avoid racing read-modify-write updates on shared flags.
Why it matters: High-connection-rate IPVS deployments gain lower per-connection overhead and more accurate overload tracking.
Other bug fixes
tracing: fix userspace-triggerable NULL pointer dereference in module event cache
Writing a module-only event filter such as ':mod:foo' for an unloaded module cached a NULL match pointer; a subsequent append write removing a specific match passed that NULL to strcmp(), crashing the kernel.
Why it matters: Unprivileged userspace could trigger a kernel NULL pointer dereference through the tracing interface on systems where tracing is accessible.
mt76: revert disabling NAPI on device removal to fix mt7921e/mt7925e hang
A previous fix that disabled RX NAPI before deletion caused napi_disable() to be called twice on mt7921e and mt7925e, where instances were already disabled earlier in unregister; since napi_disable() is not idempotent, the second call hung forever in usleep_range(). The offending commit is reverted.
Why it matters: Resolves a hard hang when unloading Mediatek mt7921e/mt7925e Wi-Fi drivers.
firewire ohci: fix NULL pointer dereference in probe error path
If pci_probe() failed early (e.g., pcim_enable_device() or MMIO mapping failure), the devres cleanup unconditionally called ar_context_release(), which dereferenced a still-NULL ctx->ohci pointer, crashing the kernel.
Why it matters: Prevents a kernel crash when a FireWire OHCI controller fails to initialize.
Source commits64 entries +
netfilter: ipset: fix refcount race between list:set GC and swap
Xiang Mei (Microsoft) · Jul 22, 2026 · 1 files
gpiolib: Check gc->get_direction() before calling gpiod_get_direction()
Christophe Leroy (CS GROUP) · Jul 29, 2026 · 1 files
ovpn: fix NULL dereference when killing missing key
Ralf Lici · Jul 29, 2026 · 1 files
ovpn: finish crypto callback cleanup before peer release
Ralf Lici · Jul 29, 2026 · 1 files
ovpn: defer key slot crypto freeing to workqueue
Ralf Lici · Jul 29, 2026 · 4 files
gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
Cengiz Can · Jul 30, 2026 · 1 files
gpio: ml-ioh: use raw_spinlock_t for the register lock
Junjie Cao · Jul 31, 2026 · 1 files
netfilter: bridge: release template ct on non-IP path
Zhiling Zou · Jul 31, 2026 · 1 files
m68k: Define NR_CPUS to 1
Uwe Kleine-König · Jul 31, 2026 · 1 files
ipvs: add totalconns for dest
Julian Anastasov · Jul 31, 2026 · 7 files
ipvs: properly update the overload flag on dest edit
Julian Anastasov · Jul 31, 2026 · 3 files
ipvs: separate destination availability state
Yizhou Zhao · Jul 31, 2026 · 9 files
netfilter: nf_conntrack: defer invalid log until after unlock
Zihan Xi · Aug 1, 2026 · 3 files
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
Florian Westphal · Aug 3, 2026 · 2 files
eth: bnxt: cancel IRQ notifier before freeing affinity mask
Jakub Kicinski · Aug 3, 2026 · 1 files
eth: bnxt: keep the aRFS rmap updated when TPH is enabled
Jakub Kicinski · Aug 3, 2026 · 1 files
eth: bnxt: decrease indent in bnxt_request_irq()
Jakub Kicinski · Aug 3, 2026 · 1 files
eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
Jakub Kicinski · Aug 3, 2026 · 2 files
af_unix: Unlink scc_entry in unix_del_edge().
Kuniyuki Iwashima · Aug 4, 2026 · 1 files
net: fix skb length accounting after generic XDP frag adjustment
Sun Jian · Aug 4, 2026 · 1 files
veth: fix skb length accounting after XDP frag adjustment
Sun Jian · Aug 4, 2026 · 1 files
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
Kyle Zeng · Aug 4, 2026 · 1 files
gpio: ml-ioh: share the register lock across channels
Junjie Cao · Aug 4, 2026 · 1 files
Revert "wifi: mt76: Disable napi when removing device"
Mikhail Gavrilov · Aug 4, 2026 · 1 files
sctp: validate cookie AUTH state before use
Jérémy Jean · Aug 4, 2026 · 3 files
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
Koichiro Den · Aug 6, 2026 · 1 files
net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
Hyunjung Ko · Aug 6, 2026 · 1 files
selftests: tc-testing: add act_ct test for malformed header handling
Hyunjung Ko · Aug 6, 2026 · 1 files
net/sched: act_gact, act_police: range check the fallback control action
Hyunjung Ko · Aug 6, 2026 · 3 files
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Eric Dumazet · Aug 6, 2026 · 1 files
ipvs: revalidate ihl to prevent out-of-bounds access
Julian Anastasov · Aug 6, 2026 · 3 files
veth: fix queue index used to wake the peer txq in veth_poll
Jonas Köppeler · Aug 6, 2026 · 1 files
net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
Oleksij Rempel · Aug 6, 2026 · 1 files
netfilter: ipset: fix list type element drift bug
Florian Westphal · Aug 6, 2026 · 1 files
netfilter: ipset: let destroy callbacks adjust ext mem size
Florian Westphal · Aug 6, 2026 · 2 files
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
Eric Dumazet · Aug 6, 2026 · 1 files
netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
Alexey Velichayshiy · Aug 6, 2026 · 1 files
mailmap: add entries for Christoph Paasch
Christoph Paasch · Aug 6, 2026 · 1 files
net: expect instance lock in netdev_queue_get_dma_dev()
Jakub Kicinski · Aug 6, 2026 · 1 files
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
Chuck Lever · Aug 7, 2026 · 1 files
selftests: tls: cover splice after a failed decrypt
Chuck Lever · Aug 7, 2026 · 1 files
tcp: fix icsk_ack.ato bitfield overflow
Jiayuan Chen · Aug 7, 2026 · 2 files
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
Jiawen Wu · Aug 7, 2026 · 1 files
net: packet: fix wrong transport_header when sending VLAN-tagged frame
Wei Fang · Aug 7, 2026 · 1 files
net: tap: fix wrong transport_header when sending VLAN-tagged frame
Wei Fang · Aug 7, 2026 · 1 files
net/sched: cls_u32: skip hash tables in u32_bind_class()
Zhang Changzhong · Aug 7, 2026 · 1 files
ovpn: run deferred work on a module-owned workqueue
Ralf Lici · Aug 7, 2026 · 4 files
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
Siddharth Vadapalli · Aug 7, 2026 · 1 files
firewire: ohci: fix NULL pointer dereference in ar_context_release
Aleksandr Nogikh · Aug 7, 2026 · 1 files
ipv4: fix use-after-free in fib_nhc_update_mtu()
Chengfeng Ye · Aug 7, 2026 · 3 files
gve: fix zero-length skb frag with header-split
Jordan Rhee · Aug 7, 2026 · 1 files
gve: fix NULL dereference due to missing ptp adjfine
Jordan Rhee · Aug 7, 2026 · 1 files
netfilter: flowtable: publish GC-visible tuple last
Jérémy Jean · Aug 8, 2026 · 1 files
sctp: fix use-after-free of cached ASCONF chunk
Yuxiang Yang · Aug 9, 2026 · 2 files
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
Jamal Hadi Salim · Aug 9, 2026 · 1 files
net/sched: cls_bpf: reject dev-bound programs bound to a different device
Jamal Hadi Salim · Aug 9, 2026 · 1 files
vxlan: do not arm the ageing timer on a device that is down
Baul Lee · Aug 9, 2026 · 1 files
tracing: Fix race between update_event_fields and, event_define_fields
Michael Wu · Aug 10, 2026 · 1 files
tipc: read le->link under the node lock in tipc_node_link_down()
Jun Yang · Aug 10, 2026 · 1 files
net/dibs: Correct freeing of dmb_clientid_arr
Alexandra Winter · Aug 10, 2026 · 2 files
af_packet: Don't send zero-byte data in tpacket_snd().
Eric Dumazet · Aug 10, 2026 · 1 files
l2tp: fix tunnel and session refcount leak on seq_file release
Eric Dumazet · Aug 11, 2026 · 2 files
sctp: clear new_transport when removing a peer
Qing Ming · Aug 11, 2026 · 1 files
tracing: Fix NULL pointer dereference in module event cache removal
Hui Su · Aug 11, 2026 · 1 files