Daily update · Aug 27–28, 2026

Networking fixes: TCP urgent data, GSO overflow, and qdisc lockups

A networking-heavy mainline batch fixes TCP urgent-data corruption, GSO segment overflow, qdisc soft lockups, and several use-after-free bugs.

Bug fixes

#netfilter #qdisc #security #stmmac #TCP

46 meaningful commitsDaily snapshot

In brief

Today's mainline commits are almost entirely networking fixes. Highlights include a TCP urgent-data corruption bug on retransmit, hardening against GSO segment-count overflow from crafted packets, and two qdisc soft-lockup fixes. Driver-specific fixes cover stmmac, slip, bnxt, and several other Ethernet drivers.

Bug fixes

TCP urgent data corruption on multi-segment retransmit

The normal transmit path refuses to build multi-segment TSO packets while in urgent mode, so every segment gets its own urgent pointer. The retransmit path lacked that guard: __tcp_retransmit_skb() could build a multi-segment skb, and the GSO split copied the same urg_ptr verbatim onto every segment. Since urg_ptr is an offset from each segment's own sequence number, the copied value pointed at the wrong place on all but the first segment.

Why it matters: Connections using TCP urgent data could have retransmitted segments with a corrupted urgent pointer, breaking urgent-data semantics for the receiver. A new packetdrill test (tcp_urg_ptr_retransmit) verifies the fix.

ce2b807f42ed 6a7e91f890ec

TCP-AO: VRF key deletion and connect race fixed

tcp_ao_del_cmd() validated the supplied VRF interface index but never assigned it to the local l3index before matching keys, so deleting a key scoped to a non-default VRF always failed with ENOENT. Separately, tcp_ao_connect_init() could observe a different L3 master than the initial validation if the device was detached from its VRF in between, causing the only matching key to be removed and a subsequent use-after-free when the no-key path cleared ao_info.

Why it matters: VRF users of TCP-AO can now delete keys correctly, and a race during connect no longer risks a use-after-free. A selftest covers VRF-scoped key deletion.

94ad9e114a1c 687e5b48c4f5 ea30dc5267e3

GSO segment-count overflow blocked for crafted packets

A packet crafted with an AF_PACKET PACKET_VNET_HDR socket can specify any gso_size, including values below TCP_MIN_GSO_SIZE (8). Dividing a large BIG TCP packet by such a small gso_size could overflow the 16-bit gso_segs field during partial GSO. virtio-net now clamps TCP gso_size to at least 8, and skb_segment() independently clamps partial_segs as a generic safeguard.

Why it matters: Prevents malformed user-generated packets from overflowing gso_segs, which could otherwise lead to incorrect GSO segmentation. The skb_segment() clamp protects all drivers, not just virtio-net.

c27c449d455a 0b13256ce37b

Two qdisc soft-lockup bugs fixed

qdisc_get_stab() accepts a user-supplied size table that can amplify qdisc_pkt_len() to about 1 GiB for an ordinary skb. Deficit schedulers such as DRR and ETS replenish one quantum per loop iteration, so with a tiny quantum they could spin billions of times under the qdisc lock. The value is now capped. Separately, htb_classify() followed filter-selected inner classes without bounding the number of hops, so a filter pointing back to itself caused an infinite loop in the classification path; a hop counter now drops the packet with a rate-limited warning.

Why it matters: Both were one-packet soft-lockup/RCU-stall triggers reachable from user space, so the fixes remove denial-of-service vectors in the packet scheduler.

8f735d64382d 729c4896ab82

slip: two use-after-free fixes

slip_devs[] stores bare net_device pointers without taking a reference, so sl_sync() could race with device teardown while walking the table. Separately, slip_hangup() simply called slip_close(), which unregisters and frees the net device; it ran concurrently with readers like slip_receive_buf() because the hangup hook is called under only a read lock on tty->ldisc_sem. The hangup hook is removed because line discipline close already handles teardown under the write lock.

Why it matters: Fixes slab use-after-free reads in slip_receive_buf() and sl_sync() when a slip device is closed or the tty hangs up, closing crash paths for this legacy protocol.

2c4e7c42d77e 23c53269f2ba

stmmac: RX alignment, TSO offload, and unicast filter fixes

The zero-copy RX path dropped NET_IP_ALIGN, so on architectures where it is 2 (like ARM32) IP headers landed misaligned, which is fatal for load-multiple instructions; the offset is restored. stmmac_xmit() also used a gso_enabled_types mask that could be zeroed when IPv4 TSO was disabled while IPv6 TSO stayed enabled, causing IPv6 GSO frames to fall through to the non-TSO path; the driver now relies on netdev features. In addition, dwmac1000/dwmac4/dwxgmac now account for the primary MAC address occupying one unicast filter slot when deciding whether to use promiscuous mode.

Why it matters: Fixes potential crashes on ARM32 from misaligned IP headers, broken IPv6 TSO offload, and incorrect unicast filtering on stmmac-based hardware (common in embedded and Amlogic/StarFive SoCs).

23680bf5f8c6 9c24a504a3af 9698b6da3714 82187f42c014 2739d6f9a2b8

nf_tables: offload ordering, set commit, and AVX2 lookup fixes

The hardware offload step now runs after building the chain blob, reducing the chance of an inconsistent state where the NIC's offloaded ruleset differs from the software ruleset. The dead bit is set earlier so deleted sets skip the commit path, fixing a regression. A double clone of set expressions on element insert is removed, and the AVX2 pipapo lookup now executes vzeroupper before returning to avoid degrading later SSE code. Several WARN_ON calls were also downgraded to debug-only to prevent panics on production systems with panic_on_warn=1.

Why it matters: Improves reliability of nftables hardware offload, fixes set commit behavior for deleted sets, avoids a performance penalty on CPUs using the AVX2 set lookup, and reduces panic risk in production.

b1881d362e19 132a02beb46f 43559058d21e 55dd20f0f4b1 1f0391aea883 9b4ab1f3fed8

Core fixes: TX watchdog, SMC leak, bridge mcast, fragment GSO

dev_activate() reset trans_start to 0 and only stamped queue 0, so other queues could appear stopped for about 49 days and trigger a false NETDEV WATCHDOG; jiffies are now stamped for all queues. IPPROTO_SMC sockets leaked their internal TCP socket when creation failed after proto->init (for example a cgroup BPF deny), which could grow kernel memory unboundedly; a .destroy hook now releases it. A use-after-free in bridge multicast teardown of master VLANs is fixed, and GSO state is now stripped from fragments before reassembly so a crafted virtio_net_hdr cannot make the reassembled datagram claim bogus GSO.

Why it matters: Fixes false watchdog timeouts on multi-queue NICs, closes an unbounded kernel memory leak, removes a bridge multicast use-after-free, and prevents malformed fragments from carrying GSO state into reassembly.

82aeed240078 cec261b0b4c5 50e5c6605cc9 d5dc1e69fd72

Driver fixes: EMAC, bnxt, PHY, wangxun, airoha, FEC, DSA

Allwinner EMAC now detects IRQ mapping failures correctly (irq_of_parse_and_map() returns 0 on error, not -ENXIO). bnxt_en writes the doorbell when linearizing an skb fails, avoiding stalled TX rings. The air_en8811h PHY reapplies LED GPIO output configuration after every MCU restart, fixing LEDs that stopped reflecting link state. Wangxun drivers use BIT_ULL() to avoid shift overflow on 32-bit builds. The airoha NPU driver sets both streaming and coherent DMA masks, fixing mailbox hangs on EN7581. FEC only stops PTP when it was initialized, and the MxL862xx DSA driver enables assisted learning on the CPU port so roaming clients get correct FDB updates.

Why it matters: Addresses device-specific bugs in Ethernet drivers used on Allwinner, Broadcom, Airoha, NXP/Freescale, and Marvell switch platforms.

991c2be78257 00eeab0c644a 03b4702fc5e3 63c885688f38 6fe7e31a45e3 dd890ae29299 88c71cc0ad98

Source commits46 entries +

1f0391aea883

netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks

Fernando Fernandez Mancera · Jun 1, 2026 · 2 files

9b4ab1f3fed8

netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit

Fernando Fernandez Mancera · Jun 1, 2026 · 1 files

5bb01c657ff9

of: fix out-of-bounds read in of_alias_scan() stem parser

Abdurrahman Hussain · Aug 5, 2026 · 1 files

b1881d362e19

netfilter: nf_tables: move hardware offload step after building the chain blob

Pablo Neira Ayuso · Aug 13, 2026 · 1 files

55dd20f0f4b1

netfilter: nft_set_pipapo_avx2: add missing vzeroupper

Eric Biggers · Aug 15, 2026 · 1 files

f43358489db4

netfilter: x_tables: remove pr_debug

Pablo Neira Ayuso · Aug 18, 2026 · 18 files

793d9eda4821

netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()

Pablo Neira Ayuso · Aug 18, 2026 · 2 files

43559058d21e

netfilter: nf_tables: skip double clone set expressions on element insert

Pablo Neira Ayuso · Aug 19, 2026 · 3 files

132a02beb46f

netfilter: nf_tables: set on dead bit when performing early element removal

Pablo Neira Ayuso · Aug 20, 2026 · 1 files

6fe7e31a45e3

net: airoha: npu: fix missing streaming DMA mask

Daniel Pawlik · Aug 20, 2026 · 1 files

fc04229727d8

netfilter: nf_tables: remove leftover set_update_list

Pablo Neira Ayuso · Aug 21, 2026 · 1 files

c27c449d455a

virtio-net: Ensure that TCP packets don't overflow gso_segs

Alice Mikityanska · Aug 22, 2026 · 1 files

0b13256ce37b

net: Guard for gso_segs overflow in skb_segment

Alice Mikityanska · Aug 22, 2026 · 1 files

dc170da3347e

selftests: net: Wait for netserver to launch

Alice Mikityanska · Aug 22, 2026 · 1 files

bb42c16f489f

selftests: net: Lower threshold on debug kernels for big_tcp_tunnels.sh

Alice Mikityanska · Aug 22, 2026 · 1 files

f7d0400bd345

selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh

Alice Mikityanska · Aug 22, 2026 · 1 files

1d62b83fb751

selftests: net: Fix slow configurations in big_tcp_tunnels.sh

Alice Mikityanska · Aug 22, 2026 · 1 files

94ad9e114a1c

net/tcp: fix TCP-AO key deletion in VRFs

Rastislav Szabo · Aug 22, 2026 · 1 files

687e5b48c4f5

selftests: net: tcp_ao: test VRF-scoped key deletion

Rastislav Szabo · Aug 22, 2026 · 3 files

03b4702fc5e3

net: phy: air_en8811h: move LED GPIO configuration to config_init

Vitaliy Sochnev · Aug 23, 2026 · 1 files

cec261b0b4c5

net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

Yifei Chu · Aug 24, 2026 · 1 files

63c885688f38

net: wangxun: use BIT_ULL() to prevent shift overflow on 32-bit archs

Jiawen Wu · Aug 24, 2026 · 2 files

9c24a504a3af

net: stmmac: drop gso_enabled_types and rely on netdev features

Lorenzo Bianconi · Aug 24, 2026 · 2 files

2c4e7c42d77e

slip: fix use-after-free in sl_sync()

Aleksandr Khromov · Aug 24, 2026 · 1 files

991c2be78257

net: ethernet: sun4i-emac: Fix IRQ error handling

bui duc phuc · Aug 24, 2026 · 1 files

23680bf5f8c6

net: stmmac: restore NET_IP_ALIGN in the RX DMA offset

Pascal Kneuper · Aug 24, 2026 · 1 files

88c71cc0ad98

net: dsa: mxl862xx: enable assisted learning on CPU port

Edoardo Pinci · Aug 24, 2026 · 1 files

ea30dc5267e3

tcp: fix AO info use-after-free in tcp_ao_connect_init()

Qing Ming · Aug 25, 2026 · 1 files

8f735d64382d

net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

Jamal Hadi Salim · Aug 25, 2026 · 2 files

82aeed240078

net: fix spurious TX timeout after dev_activate()

Breno Leitao · Aug 25, 2026 · 1 files

9a56a27e6002

net: stmmac: selftests: Pass the IP proto mask in the TC selftest

Maxime Chevallier · Aug 25, 2026 · 1 files

00eeab0c644a

bnxt_en: Write doorbell when linearizing skb fails

Joe Damato · Aug 26, 2026 · 1 files

50e5c6605cc9

net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

Norbert Szetei · Aug 26, 2026 · 1 files

dd890ae29299

net: fec: only stop PTP if it was initialized

bui duc phuc · Aug 26, 2026 · 1 files

23c53269f2ba

slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

Eric Dumazet · Aug 26, 2026 · 1 files

a60fd8c6dbaa