CVE-2026-99191 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
calipso_skbuff_setattr() adjusts payload_len by the length of the option it inserts or resizes:
payload = ntohs(ip6_hdr->payload_len); ip6_hdr->payload_len = htons(payload + len_delta);
GRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores payload_len == 0 for them; ipv6_payload_len() then falls back to skb->len. For such a packet forwarded to a destination mapped to CALIPSO, the code above writes len_delta (or 65536 + len_delta when shrinking) into payload_len, and ipv6_payload_len() no longer falls back to skb->len. nf_tables, conntrack and sch_cake rely on it.
The same arithmetic also wraps when a packet grows past IPV6_MAXPLEN, and a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its real length back.
Set payload_len from the skb length with ipv6_set_payload_len(), which stores 0 above IPV6_MAXPLEN and the real length otherwise, as ipv6_gro_complete() does. The network header was just reset to skb->data, so skb->len - sizeof(*ip6_hdr) is the payload length.
Tested on one kernel (arm64, QEMU) with SELinux permissive, a minimal mdp-generated policy (network_peer_controls=1), "netlabelctl calipso add pass doi:16" and a NetLabel mapping of fd00:2::/64 to CALIPSO DOI 16. calipso_skbuff_setattr() was called through netlbl_skbuff_setattr() from a test-only debugfs hook (not part of this patch) adding a level-only label; payload_len after the call:
case before fix after fix real length 1000, unlabeled 1016 1016 1016 70000 GSO, payload_len 0 16 0 70016 65530 GSO, grows past MAXPLEN 10 0 65546 65540 GSO with a 24 byte hop header, shrinks below MAXPLEN 65528 65532 65532 1000 with a 24 byte hop header 992 992 992
(0 means ipv6_payload_len() returns the real length.) On the forward path, with a client injecting unlabeled UDP through a router to a server, the router adds the CALIPSO option and the server delivers all datagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The Linux kernel vulnerability in the Calipso implementation involves an integer overflow and incorrect payload length calculation within the calipso_skbuff_setattr function. This flaw specifically affects IPv6 packet processing when Large Receive Offload or Generic Segmentation Offload mechanisms generate BIG TCP packets that exceed the standard maximum payload size defined by IPV6_MAXPLEN. Under normal circumstances, the ipv6_payload_len helper function relies on a fallback mechanism where it returns the actual socket buffer length if the stored payload_len field is zero. However, when Calipso processes these oversized packets for network labeling, the code directly modifies the ip6_hdr->payload_len field by adding or subtracting the delta of the inserted option size without accounting for the overflow boundary inherent in the 16-bit unsigned integer representation used for this header field.
The technical flaw manifests because the arithmetic operation performed on payload_len can wrap around when the packet length exceeds sixty-five thousand five hundred thirty-six bytes, which is the maximum value representable by a sixteen-bit unsigned integer minus the IPv6 header size constraints. When such an overflow occurs during the insertion of CALIPSO options, the resulting payload_len field contains a small incorrect value rather than zero or the correct large value. Consequently, subsequent network stack components that rely on ipv6_payload_len to determine packet boundaries fail to trigger their fallback logic. This leads to scenarios where nf_tables, connection tracking subsystems, and traffic shaping modules like sch_cake operate with erroneous length information, potentially causing data corruption, dropped packets, or incorrect policy enforcement decisions based on truncated or misinterpreted payload sizes.
The operational impact of this vulnerability is significant for systems utilizing CALIPSO security labels in high-throughput environments where offloading features are active. Specifically, routers and firewalls that inject CALIPSO options into forwarded traffic may experience packet delivery failures if the resulting length calculation wraps around to a small number. This results in the network stack treating large datagrams as truncated or malformed, leading to increased error rates such as Ip6InTruncatedPkts counters incrementing while valid Udp6InDatagrams counts drop. In practical terms, this means that security policies enforced via NetLabel and CALIPSO may fail to apply correctly to high-bandwidth flows, creating a potential bypass for access controls or causing denial of service conditions due to packet drops caused by length mismatches in the processing pipeline.
To mitigate this vulnerability, the kernel developers implemented a fix that aligns the payload length handling with the logic used in ipv6_gro_complete. The corrected approach sets the payload_len field using ipv6_set_payload_len, which intelligently stores zero for packets exceeding IPV6_MAXPLEN to preserve the fallback behavior of ipv6_payload_len, while storing the actual calculated length for smaller packets. This ensures that whether a packet grows past or shrinks below the maximum payload limit, the network stack receives accurate and consistent length information. The fix relies on resetting the network header pointer to skb->data before calculating the new payload length as the difference between the total socket buffer length and the IPv6 header size, thereby preventing integer overflows and maintaining protocol compliance across all packet sizes.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, as the root cause is the failure to handle arithmetic operations that exceed the capacity of the data type used for storage in the IPv6 header. It also relates to CWE-20 Improper Input Validation regarding the handling of packet lengths and boundaries within network processing functions. In terms of attack vectors and detection, this issue impacts the integrity of security enforcement mechanisms rather than providing a direct exploitation path for remote code execution or privilege escalation. However, it can be leveraged in denial-of-service scenarios by triggering malformed packet states that cause legitimate traffic to be dropped. Security monitoring systems should look for anomalies in IPv6 truncation counters and unexpected drops in labeled network flows on affected kernel versions.
Administrators managing Linux-based infrastructure with CALIPSO support must ensure they are running patched kernels where calipso_skbuff_setattr correctly handles payload length arithmetic. The remediation involves updating the netlabel subsystem to use ipv6_set_payload_len for consistent handling of large packets. This ensures that network security policies remain effective regardless of packet size or offloading configurations. Verification can be performed by monitoring network interface statistics for reduced truncation errors and ensuring that labeled traffic flows correctly through routers and firewalls without unexpected drops, particularly under high-load conditions where GSO is active.