[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2026-22979":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T03:17:55.401Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":23,"related":24,"reserved_at":9,"published_at":25,"modified_at":26,"state":9,"summary":27,"references_raw":29,"kevs":36,"epss":9,"epss_history":37,"metrics":38,"affected":45},"DEBIAN-CVE-2026-22979","In the Linux kernel, the following vulnerability has been resolved:  net: fix memory leak in skb_segment_list for GRO packets  When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine.  Historically, the segmentation logic in skb_segment_list assumes that individual segments are split from a parent SKB and may need to carry their own socket memory accounting. Accordingly, the code transfers truesize from the parent to the newly created segments.  Prior to commit ed4cccef64c1 (\"gro: fix ownership transfer\"), this truesize subtraction in skb_segment_list() was valid because fragments still carry a reference to the original socket.  However, commit ed4cccef64c1 (\"gro: fix ownership transfer\") changed this behavior by ensuring that fraglist entries are explicitly orphaned (skb->sk = NULL) to prevent illegal orphaning later in the stack. This change meant that the entire socket memory charge remained with the head SKB, but the corresponding accounting logic in skb_segment_list() was never updated.  As a result, the current code unconditionally adds each fragment's truesize to delta_truesize and subtracts it from the parent SKB. Since the fragments are no longer charged to the socket, this subtraction results in an effective under-count of memory when the head is freed. This causes sk_wmem_alloc to remain non-zero, preventing socket destruction and leading to a persistent memory leak.  The leak can be observed via KMEMLEAK when tearing down the networking environment:  unreferenced object 0xffff8881e6eb9100 (size 2048):   comm \"ping\", pid 6720, jiffies 4295492526   backtrace:     kmem_cache_alloc_noprof+0x5c6/0x800     sk_prot_alloc+0x5b/0x220     sk_alloc+0x35/0xa00     inet6_create.part.0+0x303/0x10d0     __sock_create+0x248/0x640     __sys_socket+0x11b/0x1d0  Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST packets constructed by GRO, the truesize adjustment is removed.  The call to skb_release_head_state() must be preserved. As documented in commit cf673ed0e057 (\"net: fix fraglist segmentation reference count leak\"), it is still required to correctly drop references to SKB extensions that may be overwritten during __copy_skb_header().",null,[],[],[],[14],{"_key":15},"CVE-2026-22979",[17,19,21],{"_key":18},"DLA-4476-1",{"_key":20},"DSA-6126-1",{"_key":22},"DSA-6127-1",[],[],"2026-01-23T16:15:53.893Z","2026-06-15T19:06:08.795421761Z",{"cisa_kev":28,"cisa_ransomware":28,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[30],{"url":31,"sources":32,"tags":34},"https://security-tracker.debian.org/tracker/CVE-2026-22979",[33],"osv_debian",[35],"Advisory",[],[],[39],{"source":33,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":40,"cvss_v4_0":9},{"baseScore":41,"baseSeverity":9,"vectorString":42,"impactScore":43,"exploitabilityScore":44},5.5,"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",6,4.6,[46,68],{"ecosystem":47,"name":48,"vendor":49,"product":48,"cpe_part":9,"purl_type":50,"purl_namespace":49,"purl_name":48,"source":9,"versions":51},"Debian","linux","debian","deb",[52,56,57,58,62,65],{"version":53,"is_range":54,"range_type":55,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":53,"is_range":54,"range_type":55,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":53,"is_range":54,"range_type":55,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":59,"is_range":54,"range_type":55,"version_start":9,"version_start_type":9,"version_end":60,"version_end_type":61,"fixed_in":9},"lt6_1_162_1","6.1.162-1","excluding",{"version":63,"is_range":54,"range_type":55,"version_start":9,"version_start_type":9,"version_end":64,"version_end_type":61,"fixed_in":9},"lt6_12_69_1","6.12.69-1",{"version":66,"is_range":54,"range_type":55,"version_start":9,"version_start_type":9,"version_end":67,"version_end_type":61,"fixed_in":9},"lt6_18_8_1","6.18.8-1",{"ecosystem":47,"name":69,"vendor":49,"product":69,"cpe_part":9,"purl_type":50,"purl_namespace":49,"purl_name":69,"source":9,"versions":70},"linux-6.1",[71,72],{"version":53,"is_range":54,"range_type":55,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":73,"is_range":54,"range_type":55,"version_start":9,"version_start_type":9,"version_end":74,"version_end_type":61,"fixed_in":9},"lt6_1_162_1~deb11u1","6.1.162-1~deb11u1"]