# CVE-2026-99191: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 28 Oct 2026
- **Updated:** 28 Oct 2026
- **Also known as:** AZL-111356, BELL-CVE-2026-99191, DEBIAN-CVE-2026-99191, GHSA-4qqv-fgh9-mg86, UBUNTU-CVE-2026-99191

## What is CVE-2026-99191?

CVE-2026-99191 is a vulnerability in Linux, published on 28 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()

calipso_skbuff_setattr() adjusts payload_len by the length of the
option it inserts or resizes:

	payload = ntohs(ip6_hdr->payload_len);
	ip6_hdr->payload_len = htons(payload + len_delta);

GRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores
payload_len == 0 for them; ipv6_payload_len() then falls back to
skb->len.  For such a packet forwarded to a destination mapped to
CALIPSO, the code above writes len_delta (or 65536 + len_delta when
shrinking) into payload_len, and ipv6_payload_len() no longer falls
back to skb->len.  nf_tables, conntrack and sch_cake rely on it.

The same arithmetic also wraps when a packet grows past IPV6_MAXPLEN,
and a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its
real length back.

Set payload_len from the skb length with ipv6_set_payload_len(), which
stores 0 above IPV6_MAXPLEN and the real length otherwise, as
ipv6_gro_complete() does.  The network header was just reset to
skb->data, so skb->len - sizeof(*ip6_hdr) is the payload length.

Tested on one kernel (arm64, QEMU) with SELinux permissive, a minimal
mdp-generated policy (network_peer_controls=1), "netlabelctl calipso
add pass doi:16" and a NetLabel mapping of fd00:2::/64 to CALIPSO
DOI 16.  calipso_skbuff_setattr() was called through
netlbl_skbuff_setattr() from a test-only debugfs hook (not part of
this patch) adding a level-only label; payload_len after the call:

  case                         before fix   after fix   real length
  1000, unlabeled                    1016        1016          1016
  70000 GSO, payload_len 0             16           0         70016
  65530 GSO, grows past MAXPLEN        10           0         65546
  65540 GSO with a 24 byte hop
  header, shrinks below MAXPLEN     65528       65532         65532
  1000 with a 24 byte hop header      992         992           992

(0 means ipv6_payload_len() returns the real length.)  On the forward
path, with a client injecting unlabeled UDP through a router to a
server, the router adds the CALIPSO option and the server delivers all
datagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.

## Which versions are affected by CVE-2026-99191?


## How do I fix CVE-2026-99191?

Upgrade to a fixed version.

## Is CVE-2026-99191 being exploited?

There is no known exploitation of CVE-2026-99191 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99191 and fix it if it is affected.

What it is: CVE-2026-99191 is a vulnerability in Linux, published on 28 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99191 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99191/ (Markdown: https://insights.sbomify.com/CVE-2026-99191/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99191
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99191
- OSV: https://osv.dev/vulnerability/CVE-2026-99191

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99191/
Summaries are generated and may contain mistakes; the official description above is the record.