CVE-2025-71085

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()<br /> <br /> There exists a kernel oops caused by a BUG_ON(nhead INT_MAX<br /> (i.e. (int)(skb_headroom(skb) + len_delta) skb_headroom(skb)) is meant to ensure<br /> that delta = headroom - skb_headroom(skb) is never negative, otherwise<br /> we will trigger a BUG_ON in pskb_expand_head(). However, if<br /> headroom &gt; INT_MAX and delta cmsg_len = cmsg_len;<br /> cmsg-&gt;cmsg_level = IPPROTO_IPV6;<br /> cmsg-&gt;cmsg_type = IPV6_HOPOPTS;<br /> char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);<br /> hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80<br /> <br /> sendmsg(fd, &amp;msg, 0);