CVE-2025-71085

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

There exists a kernel oops caused by a BUG_ON(nhead < 0) at

net/core/skbuff.c:2232 in pskb_expand_head().

This bug is triggered as part of the calipso_skbuff_setattr()

routine when skb_cow() is passed headroom > INT_MAX

(i.e. (int)(skb_headroom(skb) + len_delta) < 0).

The root cause of the bug is due to an implicit integer cast in

__skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure

that delta = headroom - skb_headroom(skb) is never negative, otherwise

we will trigger a BUG_ON in pskb_expand_head(). However, if

headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta

becomes negative, and pskb_expand_head() is passed a negative value for

nhead.

Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing

"negative" headroom sizes to skb_cow() within calipso_skbuff_setattr()

by only using skb_cow() to grow

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References