Hi Jamal, Thanks for offering to reproduce this. I have a fix below. The length passed to pskb_may_pull() is computed from ipl and the network header offset. With an IPv6 jumbogram, that unsigned addition can wrap, allowing the helper to accept a short skb before the checksum path uses the original length. The patch computes the pull length in s64 and checks it against skb->len before calling pskb_may_pull(). I tested this on c339f4010dea8 with the posted reproducer. The unpatched kernel matched the root-seeded checksum in 45/512 trials. With the patch, the malformed packet was dropped (tc action stats: dropped 1). A normal IPv6 UDP-Lite packet still had its checksum updated. net/sched: act_csum: guard skb pull length overflow An IPv6 Jumbo Payload option can provide a length close to UINT_MAX. Adding the network-header offset before the pskb_may_pull() check can wrap the requested length to zero or another short value. The checksum code then uses the original length and may read beyond skb->len. Calculate the pull length in s64, reject negative values and values past skb->len, then narrow the value for pskb_may_pull(). Fixes: eb4d40654505 ("net/sched: add ACT_CSUM action to update packets checksums") Link: https://lkml.iu.edu/hypermail/linux/kernel/2610.2/16452.html Link: https://lists.openwall.net/netdev/2026/08/24/344 Signed-off-by: shaos --- net/sched/act_csum.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c index 5fff52a8ca90d..196b940cd6230 100644 --- a/net/sched/act_csum.c +++ b/net/sched/act_csum.c @@ -137,8 +137,10 @@ static void *tcf_csum_skb_nextlayer(struct sk_buff *skb, { int ntkoff = skb_network_offset(skb); int hl = ihl + jhl; + s64 pull_len = (s64)ipl + ntkoff; - if (!pskb_may_pull(skb, ipl + ntkoff) || (ipl < hl) || + if (ipl < hl || pull_len < 0 || pull_len > (s64)skb->len || + !pskb_may_pull(skb, (unsigned int)pull_len) || skb_try_make_writable(skb, hl + ntkoff)) return NULL; else -- 2.34.1