)]}'
{
  "commit": "9b2019e2a0a65bafcc7fb941120bfa3088ef8a59",
  "tree": "a7bb8fe3305ceb4c3babfab60b2ba56945c19d94",
  "parents": [
    "9660cea1cd92195ea50cc4031f0fb7083bb630fd"
  ],
  "author": {
    "name": "William Bowling",
    "email": "vakzz@zellic.io",
    "time": "Wed May 13 04:16:35 2026 +0000"
  },
  "committer": {
    "name": "Kevin Berry",
    "email": "kpberry@google.com",
    "time": "Thu Jun 04 10:45:56 2026 -0700"
  },
  "message": "net: skbuff: preserve shared-frag marker during coalescing\n\ncommit f84eca5817390257cef78013d0112481c503b4a3 upstream.\n\nskb_try_coalesce() can attach paged frags from @from to @to.  If @from\nhas SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same\nexternally-owned or page-cache-backed frags, but the shared-frag marker\nis currently lost.\n\nThat breaks the invariant relied on by later in-place writers.  In\nparticular, ESP input checks skb_has_shared_frag() before deciding\nwhether an uncloned nonlinear skb can skip skb_cow_data().  If TCP\nreceive coalescing has moved shared frags into an unmarked skb, ESP can\nsee skb_has_shared_frag() as false and decrypt in place over page-cache\nbacked frags.\n\nPropagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged\nfrags.  The tailroom copy path does not need the marker because it copies\nbytes into @to\u0027s linear data rather than transferring frag descriptors.\n\nBUG\u003db/517288938\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-46300 in the Linux kernel.\n\ncos-patch: security-high\nFixes: cef401de7be8 (\"net: fix possible wrong checksum generation\")\nFixes: f4c50a4034e6 (\"xfrm: esp: avoid in-place decrypt on shared skb frags\")\nChange-Id: I8870a473d50b49c4d21f75b6a590c38fb39351b1\nSigned-off-by: William Bowling \u003cvakzz@zellic.io\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nTested-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20260513041635.1289541-1-vakzz@zellic.io\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/156403\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Liu \u003czhihuil@google.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "828333fb4c691aec09c7e74385ea5450f4fcbf24",
      "old_mode": 33188,
      "old_path": "net/core/skbuff.c",
      "new_id": "4900def3e5afaa4fc6934bad864be0f17e502bcc",
      "new_mode": 33188,
      "new_path": "net/core/skbuff.c"
    }
  ]
}