Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni [off-list ref]:

On Tue, 30 Jun 2026 10:41:09 -0700 you wrote:

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes
the skb straight to __rmnet_map_ingress_handler(), skipping the length
validation that rmnet_map_deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt_len without checking skb->len, so a short frame is read out
of bounds:

[...]

Here is the summary with links:
  - [net,v2] net: qualcomm: rmnet: validate MAP frame length before ingress parsing
    https://git.kernel.org/netdev/net/c/f0f1887a9e30

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html