)]}'
{
  "commit": "3220615da162e0194ca698feb342f7985fdc2709",
  "tree": "c1f0251f2421599fd39b6acb6e92f9b5adc53f8c",
  "parents": [
    "e72523329fe93b1b9b9ac8bedadb3bf5ff6c0cc1"
  ],
  "author": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Wed Oct 07 18:42:49 2026 -0400"
  },
  "committer": {
    "name": "Robert Kolchmeyer",
    "email": "rkolchmeyer@google.com",
    "time": "Fri Oct 16 14:40:47 2026 -0700"
  },
  "message": "ipv4: validate checksum_start before completing checksum\n\ncommit 6785011f8b16abf40b1e9d8b2e332232b3e68822 upstream.\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.\n\nBUG\u003db/574436234\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-99999 in the Linux kernel.\n\ncos-patch: security-high\nCc: stable@vger.kernel.org\nFixes: f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\")\nFixes: bfd5f4a3d605 (\"packet: Add GSO/csum offload support.\")\nReported-by: Paulos Yibelo \u003chabte.yibelo@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/20260922030310.8684-2-habte.yibelo@gmail.com/\nChange-Id: Id68e338d847f06ba32a7f669e7bad0be0cc5d433\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/0a012b4923e189c4c593ef4f471e5ff0edbe9030.1791412497.git.mst@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit a65f69e0f38ffbed1b128029e09097436416dc8b)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/226867\nReviewed-by: Derek Taylor \u003cddtaylor@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "baea9acd7e85fdbb32b4803a573339a4c22b15b1",
      "old_mode": 33188,
      "old_path": "include/net/ip.h",
      "new_id": "32825e2ac43d351b01122b40a8ae1b5dbec4cfe2",
      "new_mode": 33188,
      "new_path": "include/net/ip.h"
    },
    {
      "type": "modify",
      "old_id": "8834a45f697b8d9731bbe6b679e6653168a01d1b",
      "old_mode": 33188,
      "old_path": "net/bridge/netfilter/nf_conntrack_bridge.c",
      "new_id": "3b75d5b2161717af6335f2c0b113f586f0cd300b",
      "new_mode": 33188,
      "new_path": "net/bridge/netfilter/nf_conntrack_bridge.c"
    },
    {
      "type": "modify",
      "old_id": "3bb198b2c101c75660caeca1b4b3264e575c59b0",
      "old_mode": 33188,
      "old_path": "net/ipv4/ip_output.c",
      "new_id": "c8f966d8c77f9b9830889095943a024c36a4727b",
      "new_mode": 33188,
      "new_path": "net/ipv4/ip_output.c"
    },
    {
      "type": "modify",
      "old_id": "06cc26b9dac112c2cc45c873011c93d3f5871983",
      "old_mode": 33188,
      "old_path": "net/netfilter/nfnetlink_queue.c",
      "new_id": "1944fba91b02184158462512b444683fb337f373",
      "new_mode": 33188,
      "new_path": "net/netfilter/nfnetlink_queue.c"
    },
    {
      "type": "modify",
      "old_id": "9d99f5a3d1764bd84e3e04d2aca739840b0b51da",
      "old_mode": 33188,
      "old_path": "net/netfilter/xt_CHECKSUM.c",
      "new_id": "1fb0f8118404d6b4e44d11742aea591a90b18e45",
      "new_mode": 33188,
      "new_path": "net/netfilter/xt_CHECKSUM.c"
    },
    {
      "type": "modify",
      "old_id": "53654c5fa9e9885af733529b55ff445663d47aee",
      "old_mode": 33188,
      "old_path": "net/xfrm/xfrm_output.c",
      "new_id": "21aa65caf0c696b695cc19c47ac472aa1b5768fb",
      "new_mode": 33188,
      "new_path": "net/xfrm/xfrm_output.c"
    }
  ]
}