On Sat, Aug 30, 2025 at 4:37 PM F6BVP [off-list ref] wrote:

Here is a bad commit report by git bisect and the corresponding decoded
stack trace of kernel panic triggered when mkiss receives AX25 packet.

All kernels following 6.14.11, i.e. starting with 6.15.1 until net-next
are affected by the issue.

I would be pleased to check any patch correcting the issue.

Thanks for the report.

At some point we will have to remove ax25, this has been quite broken
for a long time.

Please try :

diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 1cac25aca637..f2d66af86359 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c

@@ -433,6 +433,10 @@ static int ax25_rcv(struct sk_buff *skb, struct

net_device *dev,
 int ax25_kiss_rcv(struct sk_buff *skb, struct net_device *dev,
                  struct packet_type *ptype, struct net_device *orig_dev)
 {
+       skb = skb_share_check(skb, GFP_ATOMIC);
+       if (!skb)
+               return NET_RX_DROP;
+
        skb_orphan(skb);

        if (!net_eq(dev_net(dev), &init_net)) {