[ciqlts9_2] ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

jira VULN-204569
cve CVE-2026-74597
commit-author Zhiling Zou <zhilinz@nebusec.ai>
commit f803c086399da277b5d0ff36a107d0f162751800

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	24m 30s	25m 24s
aarch64	8m 44s	9m 19s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	174	24	ciqlts9_2	✅ No regressions
aarch64	144	24	ciqlts9_2	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1439	81	ciqlts9_2	✅ No regressions
aarch64	1409	83	ciqlts9_2	✅ No regressions

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 34249007744

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/34273897662

[github-actions]

JIRA PR Check Results

1 commit(s) with issues found:

Commit ee0298f3d855

Summary: ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

❌ Errors:

• VULN-204569: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-204569: No time logged - please log time manually

---

Summary: Checked 1 commit(s) total.

[github-actions]

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/34273897662

[kerneltoast]

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/34361445465

[github-actions]

JIRA PR Check Results

98 commit(s) with issues found:

Commit 745855b119dd

Summary: net: ipv6: clear suppressed fib6 rule result

❌ Errors:

• VULN-204224: Status is 'Publish CSAF', expected 'In Progress'

Commit cbffa46d1fe5

Summary: ipc: limit next_id allocation to the valid ID range

❌ Errors:

• VULN-189040: Status is 'Done', expected 'In Progress'

Commit 33f4dcc46b50

Summary: ALSA: usb-audio: Add sanity check for OOB writes at silencing

❌ Errors:

• VULN-184732: Status is 'Done', expected 'In Progress'

Commit 032122be2626

Summary: net: use dst_dev_rcu() in sk_setup_caps()

❌ Errors:

• VULN-160265: Status is 'Done', expected 'In Progress'

Commit bf968fae197f

Summary: ipv6: use RCU in ip6_output()

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit b005c8bf5fe3

Summary: ipv6: use RCU in ip6_xmit()

❌ Errors:

• VULN-160160: Status is 'Done', expected 'In Progress'

Commit a2f218895d1b

Summary: net: dst: introduce dst->dev_rcu

❌ Errors:

• VULN-160265: Status is 'Done', expected 'In Progress'

Commit 49f63911a13e

Summary: net: Add locking to protect skb->dev access in ip_output

❌ Errors:

• VULN-160160: Status is 'Done', expected 'In Progress'

Commit 16269762d104

Summary: net: dst: add four helpers to annotate data-races around dst->dev

❌ Errors:

• VULN-160265: Status is 'Done', expected 'In Progress'

Commit 7d91a59595f9

Summary: ipv6: use RCU protection in ip6_default_advmss()

❌ Errors:

• VULN-53991: Status is 'Done', expected 'In Progress'

Commit 07a002fb40d0

Summary: ipv4: use RCU protection in __ip_rt_update_pmtu()

❌ Errors:

• VULN-54043: Status is 'Done', expected 'In Progress'

Commit 97a08d4f99a2

Summary: ipv4: use RCU protection in ip_dst_mtu_maybe_forward()

❌ Errors:

• VULN-160265: Status is 'Done', expected 'In Progress'

Commit 271ab7e00702

Summary: ipv4: add RCU protection to ip4_dst_hoplimit()

❌ Errors:

• VULN-160265: Status is 'Done', expected 'In Progress'

Commit 5033f9df3276

Summary: bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit 19f49e6f2c48

Summary: ipv6: prevent possible UAF in ip6_xmit()

❌ Errors:

• VULN-8328: Status is 'Done', expected 'In Progress'

Commit 09850a7fc309

Summary: ipv6: fix possible UAF in ip6_finish_output2()

❌ Errors:

• VULN-8330: Status is 'Done', expected 'In Progress'

Commit 627e8e4e7574

Summary: vrf: Fix lockdep splat in output path

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit db17850bf8a7

Summary: udp6: Fix race condition in udp6_sendmsg & connect

❌ Errors:

• VULN-160265: Status is 'Done', expected 'In Progress'

Commit 8d8f29075bfd

Summary: ipv6: remove nexthop_fib6_nh_bh()

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit c271f5a5e5db

Summary: net: remove rcu_dereference_bh_rtnl()

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit ac2f103e688a

Summary: neighbour: switch to standard rcu, instead of rcu_bh

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit f35485133d27

Summary: ipv6: flowlabel: do not disable BH where not needed

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit d9ed64fff525

Summary: ipv6: remove one read_lock()/read_unlock() pair in rt6_check_neigh()

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit a49460ee5aaf

Summary: ipv6: refactor ip6_finish_output2()

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit 3dc13993ee24

Summary: neigh: introduce neigh_confirm() helper function

❌ Errors:

• VULN-160216: Status is 'Done', expected 'In Progress'

Commit fe9ce54ad4a4

Summary: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward

❌ Errors:

• VULN-160265: Status is 'Done', expected 'In Progress'

Commit b9e33973332f

Summary: net: ipv6: introduce ip6_dst_mtu_maybe_forward

❌ Errors:

• VULN-160265: Status is 'Done', expected 'In Progress'

Commit 6ea4088051af

Summary: can: j1939: add missing calls in NETDEV_UNREGISTER notification handler

❌ Errors:

• VULN-157326: Status is 'Done', expected 'In Progress'

Commit e9c7ccbec5f5

Summary: can: j1939: make j1939_sk_bind() fail if device is no longer registered

❌ Errors:

• VULN-157326: Status is 'Done', expected 'In Progress'

Commit 7d8be844e2eb

Summary: can: j1939: implement NETDEV_UNREGISTER notification handler

❌ Errors:

• VULN-157326: Status is 'Done', expected 'In Progress'

Commit 3aa990012a66

Summary: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock

❌ Errors:

• VULN-35294: Status is 'Done', expected 'In Progress'

Commit a0cb2cc5a237

Summary: md/bitmap: fix GPF in write_page caused by resize race

❌ Errors:

• VULN-184500: Status is 'Done', expected 'In Progress'

Commit 2a0263a02641

Summary: e1000e: fix heap overflow in e1000_set_eeprom

❌ Errors:

• VULN-157276: Status is 'Done', expected 'In Progress'

Commit 3c3f8dce2552

Summary: net: openvswitch: fix nested key length validation in the set() action

❌ Errors:

• VULN-66719: Status is 'Done', expected 'In Progress'

Commit 0475cab1ba28

Summary: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

❌ Errors:

• VULN-64828: Status is 'Done', expected 'In Progress'

Commit 4c9a9d7c9133

Summary: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

❌ Errors:

• VULN-56205: Status is 'Done', expected 'In Progress'

Commit ebe5c90f8918

Summary: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()

❌ Errors:

• VULN-56020: Status is 'Done', expected 'In Progress'

Commit 3f352099afd0

Summary: wifi: iwlwifi: limit printed string from FW file

❌ Errors:

• VULN-55869: Status is 'Done', expected 'In Progress'

Commit 216dca76c17f

Summary: xen/privcmd: fix double free via VMA splitting

❌ Errors:

• VULN-183595: Status is 'Done', expected 'In Progress'

Commit 7ef7425c6fd3

Summary: gfs2: Fix use-after-free in iomap inline data write path

❌ Errors:

• VULN-186354: Status is 'Done', expected 'In Progress'

Commit 37d716de1ca5

Summary: gfs2: Add metapath_dibh helper

❌ Errors:

• VULN-186354: Status is 'Done', expected 'In Progress'

Commit 1f56a2f649b0

Summary: media: uvcvideo: Fix double free in error path

❌ Errors:

• VULN-53325: Status is 'Done', expected 'In Progress'

Commit 23a3c31e5d86

Summary: bpf: fix OOB devmap writes when deleting elements

❌ Errors:

• VULN-41314: Status is 'Done', expected 'In Progress'

Commit 8f9a3c714ff5

Summary: xsk: fix OOB map writes when deleting elements

❌ Errors:

• VULN-41341: Status is 'Done', expected 'In Progress'

Commit 1b3954234195

Summary: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof

❌ Errors:

• VULN-46390: Status is 'Done', expected 'In Progress'

Commit 672f44626850

Summary: HID: core: zero-initialize the report buffer

❌ Errors:

• VULN-40851: Status is 'Done', expected 'In Progress'

Commit 5d2400fb62ef

Summary: ethtool: check device is present when getting link settings

❌ Errors:

• VULN-48139: Status is 'Done', expected 'In Progress'

Commit 6ee5029a051d

Summary: net/iucv: fix use after free in iucv_sock_close()

❌ Errors:

• VULN-38708: Status is 'Done', expected 'In Progress'

Commit 383635c2ca24

Summary: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket

❌ Errors:

• VULN-38649: Status is 'Done', expected 'In Progress'

Commit 9c4f4a2ed4a5

Summary: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

❌ Errors:

• VULN-187129: Status is 'Done', expected 'In Progress'

Commit 4ffd9b5f28cd

Summary: net: sched: act_csum: validate nested VLAN headers

❌ Errors:

• VULN-183029: Status is 'Done', expected 'In Progress'

Commit 5a54b9ff70de

Summary: KVM: x86: Check for invalid/obsolete root after making MMU pages available

❌ Errors:

• VULN-195552: Status is 'Done', expected 'In Progress'

Commit 9aee8a5ca8d2

Summary: net/sched: act_api: use RCU with deferred freeing for action lifecycle

❌ Errors:

• VULN-189811: Status is 'Done', expected 'In Progress'

Commit 0bf780c5a506

Summary: xfs: add bounds checking to xlog_recover_process_data

❌ Errors:

• VULN-43864: Status is 'Done', expected 'In Progress'

Commit 1bf3bf9f5fac

Summary: drm/amdgpu: avoid using null object of framebuffer

❌ Errors:

• VULN-38380: Status is 'Done', expected 'In Progress'

Commit 5273ac91ff4c

Summary: powerpc/eeh: avoid possible crash when edev->pdev changes

❌ Errors:

• VULN-44085: Status is 'Done', expected 'In Progress'

Commit 8306a1ad1814

Summary: drm/radeon: fix UBSAN warning in kv_dpm.c

❌ Errors:

• VULN-43677: Status is 'Done', expected 'In Progress'

Commit cda907397371

Summary: tipc: force a dst refcount before doing decryption

❌ Errors:

• VULN-43654: Status is 'Done', expected 'In Progress'

Commit 30f63ff1e94f

Summary: ipv6: prevent possible NULL dereference in rt6_probe()

❌ Errors:

• VULN-48033: Status is 'Done', expected 'In Progress'

Commit 5260e4f0591b

Summary: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."

❌ Errors:

• VULN-43665: Status is 'Done', expected 'In Progress'

Commit 77b4f7945db1

Summary: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER

❌ Errors:

• VULN-44388: Status is 'Done', expected 'In Progress'

Commit c279ddbe21f0

Summary: netfilter: nf_conntrack_helper: pass helper to expect cleanup

❌ Errors:

• VULN-183689: Status is 'Done', expected 'In Progress'

Commit a411ac17b51c

Summary: nvme: avoid double free special payload

❌ Errors:

• VULN-44150: Status is 'Done', expected 'In Progress'

Commit e9dfc2ee4355

Summary: mptcp: ensure snd_una is properly initialized on connect

❌ Errors:

• VULN-47918: Status is 'Done', expected 'In Progress'

Commit 35d5000df80d

Summary: netfilter: tproxy: bail out if IP has been disabled on the device

❌ Errors:

• VULN-5295: Status is 'Done', expected 'In Progress'

Commit d942af546fe4

Summary: nvmet: fix a possible leak when destroy a ctrl during qp establishment

❌ Errors:

• VULN-38461: Status is 'Done', expected 'In Progress'

Commit fe0624f58d62

Summary: mm/huge_memory: don't unpoison huge_zero_folio

❌ Errors:

• VULN-47839: Status is 'Done', expected 'In Progress'

Commit b081d44a5480

Summary: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

❌ Errors:

• VULN-5018: Status is 'Done', expected 'In Progress'

Commit cf05d865c8cb

Summary: r8169: Fix possible ring buffer corruption on fragmented Tx packets.

❌ Errors:

• VULN-43374: Status is 'Done', expected 'In Progress'

Commit bcab6e390363

Summary: tls: fix missing memory barrier in tls_init

❌ Errors:

• VULN-5311: Status is 'Done', expected 'In Progress'

Commit 3bf33e5d350b

Summary: NFSv4: Fix memory leak in nfs4_set_security_label

❌ Errors:

• VULN-44160: Status is 'Done', expected 'In Progress'

Commit 8c7511342c61

Summary: tcp: Fix shift-out-of-bounds in dctcp_update_alpha().

❌ Errors:

• VULN-43193: Status is 'Done', expected 'In Progress'

Commit d44038674232

Summary: blk-cgroup: fix list corruption from resetting io stat

❌ Errors:

• VULN-43203: Status is 'Done', expected 'In Progress'

Commit adab5392b9b8

Summary: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued

❌ Errors:

• VULN-47608: Status is 'Done', expected 'In Progress'

Commit a72d3710e829

Summary: net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state

❌ Errors:

• VULN-5460: CVE mismatch - Commit has CVE-2024-40921 but VULN ticket does not
• VULN-5460: Status is 'Done', expected 'In Progress'

⚠️ Warnings:

• VULN-5460: VULN ticket has CVE-2024-36979 but commit does not

Commit 703c73dc55ee

Summary: net: bridge: mst: fix suspicious rcu usage in br_mst_set_state

❌ Errors:

• VULN-5460: CVE mismatch - Commit has CVE-2024-40920 but VULN ticket does not
• VULN-5460: Status is 'Done', expected 'In Progress'

⚠️ Warnings:

• VULN-5460: VULN ticket has CVE-2024-36979 but commit does not

Commit b734b5f19b9e

Summary: net: bridge: mst: fix vlan use-after-free

❌ Errors:

• VULN-5460: Status is 'Done', expected 'In Progress'

Commit 6def658f1a45

Summary: net/mlx5: Discard command completions in internal error

❌ Errors:

• VULN-5476: Status is 'Done', expected 'In Progress'

Commit d12ced0dcb32

Summary: net: openvswitch: fix overwriting ct original tuple for ICMPv6

❌ Errors:

• VULN-43288: Status is 'Done', expected 'In Progress'

Commit bf7f426c32d8

Summary: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

❌ Errors:

• VULN-5500: Status is 'Done', expected 'In Progress'

Commit f51832bcc8f0

Summary: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

❌ Errors:

• VULN-190208: Status is 'Done', expected 'In Progress'

Commit 2d9a2f59e931

Summary: rtmutex: Use waiter::task instead of current in remove_waiter()

❌ Errors:

• VULN-191595: Status is 'Done', expected 'In Progress'

Commit a8c65a6669b0

Summary: exit: prevent preemption of oopsing TASK_DEAD task

❌ Errors:

• VULN-187123: Status is 'Done', expected 'In Progress'

Commit 9fd3a83b9e72

Summary: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

❌ Errors:

• VULN-188154: Status is 'Done', expected 'In Progress'

Commit 8a817d92a5c2

Summary: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

❌ Errors:

• VULN-187923: Status is 'Done', expected 'In Progress'

Commit 848ea41027c3

Summary: netfilter: flowtable: strictly check for maximum number of actions

❌ Errors:

• VULN-185474: Status is 'Done', expected 'In Progress'

Commit c261c28ea0a0

Summary: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

❌ Errors:

• VULN-180255: Status is 'Done', expected 'In Progress'

Commit 992c4f0db9bb

Summary: Bluetooth: SCO: Fix UAF on sco_sock_timeout

❌ Errors:

• VULN-8628: Status is 'Done', expected 'In Progress'

Commit dde12f23c19e

Summary: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

❌ Errors:

• VULN-65614: Status is 'Done', expected 'In Progress'

Commit 3c9a2bfa5139

Summary: RDMA/umem: Fix double dma_buf_unpin in failure path

❌ Errors:

• VULN-184378: Status is 'Done', expected 'In Progress'

Commit ae2974e2d940

Summary: page_pool: Fix use-after-free in page_pool_recycle_in_ring

❌ Errors:

• VULN-71838: Status is 'Done', expected 'In Progress'

Commit a82554e9dcd4

Summary: page_pool: fix inconsistency for page_pool_ring_[un]lock()

❌ Errors:

• VULN-71838: Status is 'Done', expected 'In Progress'

Commit d04070d6c831

Summary: net: page_pool: use in_softirq() instead

❌ Errors:

• VULN-71838: Status is 'Done', expected 'In Progress'

Commit 9ecd0b37a847

Summary: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

❌ Errors:

• VULN-71153: Status is 'Done', expected 'In Progress'

Commit 916af3b1d953

Summary: scsi: qedf: Ensure the copied buf is NUL terminated

❌ Errors:

• VULN-43278: Status is 'Done', expected 'In Progress'

Commit fe2fdb1f7977

Summary: stm class: Fix a double free in stm_register_device()

❌ Errors:

• VULN-5524: Status is 'Done', expected 'In Progress'

Commit 93675c2e1294

Summary: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation

❌ Errors:

• VULN-5271: Status is 'Done', expected 'In Progress'

Commit aa6a74f8529f

Summary: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

❌ Errors:

• VULN-47125: Status is 'Done', expected 'In Progress'

---

Summary: Checked 100 commit(s) total.

[github-actions]

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/34361445465

[bmastbergen]

🥌