CVE-2026-53366

In the Linux kernel, the following vulnerability has been resolved:

ipv4: account for fraggap on the paged allocation path

In __ip_append_data(), when the paged-allocation branch is taken,

alloclen and pagedlen are computed as

alloclen = fragheaderlen + transhdrlen;

pagedlen = datalen - transhdrlen;

datalen already includes fraggap, but the fraggap bytes carried over

from the previous skb are copied into the new skb's linear area at

offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The

linear area is therefore undersized by fraggap bytes while pagedlen is

overstated by the same amount.

The non-paged branch sets alloclen to fraglen, which already accounts

for fraggap because datalen does. Bring the paged branch in line by

adding fraggap to alloclen and subtracting it from pagedlen.

After this adjustment, copy no longer collapses to -fraggap on the

paged path, so remove the stale comment describing that old arithmetic.