--- id: "CVE-2026-99191" kind: "vulnerability" aliases: ["CVE-2026-99191"] title: "Linux kernel: CALIPSO labeling corrupts IPv6 payload length on BIG TCP packets" severity: "unknown" cvss: null epss: null exploited: false status: "open" category: "runtime" products: [] ecosystems: [] tags: ["calipso", "ipv6", "linux-kernel", "netlabel", "runtime"] not_affected_if: ["no-calipso-configured"] published_at: "2026-10-28T11:17:40+00:00" first_seen_at: "2026-10-28T11:32:37+00:00" updated_at: "2026-10-28T11:34:13+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99191", "first_seen_at": "2026-10-28T11:32:37+00:00"}] --- # Linux kernel: CALIPSO labeling corrupts IPv6 payload length on BIG TCP packets The Linux kernel's CALIPSO IPv6 labeling code miscalculates the payload length field when it inserts or resizes a CALIPSO option on BIG TCP (GRO) packets. The wrong length can break packet handling in netfilter, conntrack and the sch_cake scheduler. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Run `uname -r` and compare against the fixed kernel release in your distribution's advisory - Check whether CALIPSO is in use with `netlabelctl calipso list` or by looking for CALIPSO DOI mappings - unknown if the sources give further checks ## Fix - Update the Linux kernel to a release that includes the calipso payload_len fix (version unknown from the sources) - unknown for any setting change, since the sources do not name one ## Timeline - 2026-10-28T11:32:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99191 ## From the sources In the Linux kernel, the following vulnerability has been resolved: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() calipso_skbuff_setattr() adjusts payload_len by the length of the option it inserts or resizes: payload = ntohs(ip6_hdr->payload_len); ip6_hdr->payload_len = htons(payload + len_delta); GRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores payload_len == 0 for them; ipv6_payload_len() then falls back to skb->len. For such a packet forwarded to a destination mapped to CALIPSO, the code above writes len_delta (or 65536 + len_delta when shrinking) into payload_len, and ipv6_payload_len() no longer falls back to skb->len. nf_tables, conntrack and sch_cake rely on it. The same arithmetic also wraps when a packet grows past IPV6_MAXPLEN, and a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its real length back. Set payload_len from the skb length with ipv6_set_payload_len(), which stores 0 above IPV6_MAXPLEN and the real length otherwise, as ipv6_gro_complete() does. The network header was just reset to skb->data, so skb->len - sizeof(*ip6_hdr) is the payload length. Tested on one kernel (arm64, QEMU) with SELinux permissive, a minimal mdp-generated policy (network_peer_controls=1), "netlabelctl calipso add pass doi:16" and a NetLabel mapping of fd00:2::/64 to CALIPSO DOI 16. calipso_skbuff_setattr() was called through netlbl_skbuff_setattr() from a test-only debugfs hook (not part of this patch) adding a level-only label; payload_len after the call: case before fix after fix real length 1000, unlabeled 1016 1016 1016 70000 GSO, payload_len 0 16 0 70016 65530 GSO, grows past MAXPLEN 10 0 65546 65540 GSO with a 24 byte hop header, shrinks below MAXPLEN 65528 65532 65532 1000 with a 24 byte hop header 992 992 992 (0 means ipv6_payload_len() returns the real length.) On the forward path, with a client injecting unlabeled UDP through a router to a server, the router adds the CALIPSO option and the server delivers all datagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_