CVE-2026-22979

In the Linux kernel, the following vulnerability has been resolved:

net: fix memory leak in skb_segment_list for GRO packets

When skb_segment_list() is called during packet forwarding, it handles

packets that were aggregated by the GRO engine.

Historically, the segmentation logic in skb_segment_list assumes that

individual segments are split from a parent SKB and may need to carry

their own socket memory accounting. Accordingly, the code transfers

truesize from the parent to the newly created segments.

Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this

truesize subtraction in skb_segment_list() was valid because fragments

still carry a reference to the original socket.

However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed

this behavior by ensuring that fraglist entries are explicitly

orphaned (skb->sk = NULL) to prevent illegal orphaning later in the

stack. This change meant that the entire socket memory charge remained

with the head SKB, but the corresponding accounting logic in

skb_segment_list() was never updated.

As a result, the current code unconditionally adds each fragment's

truesize to delta_truesize and subtracts it from the parent SKB. Since

the fragments are no longer charged to the socket, this subtraction

results in an effective under-count of memory when the head is freed.

This causes sk_wmem_alloc to remain non-zero, preventing socket

destruction and leading to a persistent memory leak.

The leak can be observed via KMEMLEAK when tearing down the networking

environment:

unreferenced object 0xffff8881e6eb9100 (size 2048):

comm "ping", pid 6720, jiffies 4295492526

backtrace:

kmem_cache_alloc_noprof+0x5c6/0x800

sk_prot_alloc+0x5b/0x220

sk_alloc+0x35/0xa00

inet6_create.part.0+0x303/0x10d0

__sock_create+0x248/0x640

__sys_socket+0x11b/0x1d0

Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST

packets constructed by GRO, the truesize adjustment is removed.

The call to skb_release_head_state() must be preserved. As documented in

commit cf673ed0e057 ("net: fix fraglist segmentation reference count

leak"), it is still required to correctly drop references to SKB

extensions that may be overwritten during __copy_skb_header().