Re: [BUG] net/sched: act_ife can emit uninitialized bytes for zero metadata

On Thu, Oct 22, 2026 at 02:47:39PM +0000, shaos wrote:

Hello,

An attacker with only namespace-scoped CAP_NET_ADMIN and CAP_NET_RAW installs a matchall IFE encode action carrying a zero-valued skb mark in a fresh user/network namespace. The presence callback reserves an 8-byte TLV, but the encoder emits no value bytes. The resulting frame contains six bytes from a freed kmalloc object previously populated by a different UID.

You sent these all to public mailing lists, and you seem to have
forgotten to include a patch for them?  Please do so.

thanks,

greg k-h