WARNING in udp_v6_send_skb

Status: upstream: reported on 2026/07/30 00:10
Subsystems: net
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+ce13c07d96d04716eaa2@syzkaller.appspotmail.com
Fix commit: b83641e0ab8b net: ipv4: Fix UDP length overflow with PMTU discover and big MTU 0ae10b6be49b net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-rust-kasan-gce ci2-upstream-usb]
First crash: 58d, last: 1d04h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
8cbcb09d repro 💥 WARNING in udp_v6_send_skb 2026/07/30 09:10 2026/07/30 09:10 2026/07/30 09:44 2377cd3d
9402638d assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ WARNING in udp_v6_send_skb 2026/07/27 00:00 2026/07/27 00:00 2026/07/27 00:52 492bab15
Discussions (9)
Title Replies (including bot) Last reply
[PATCH net v5 2/4] net: ipv6: Fix UDP length overflow with PMTU discover and big MTU 1 (1) 2026/09/01 19:57
[PATCH net v5 1/4] net: ipv4: Fix UDP length overflow with PMTU discover and big MTU 1 (1) 2026/09/01 19:57
[PATCH net v4 2/4] net: ipv6: Fix UDP length overflow with PMTU discover and big MTU 1 (1) 2026/08/25 20:02
[PATCH net v4 1/4] net: ipv4: Fix UDP length overflow with PMTU discover and big MTU 1 (1) 2026/08/25 20:02
[PATCH net v3 2/4] net: ipv6: Fix UDP length overflow with PMTU discover and big MTU 2 (2) 2026/08/22 18:39
[PATCH net v3 1/4] net: ipv4: Fix UDP length overflow with PMTU discover and big MTU 2 (2) 2026/08/22 18:35
[PATCH net v2 1/2] net: Fix UDP length overflow with PMTU discover and big MTU 3 (3) 2026/08/17 18:31
[PATCH net-next 4/4] net: Fix UDP length overflow with PMTU discover and big MTU 5 (5) 2026/08/13 12:04
[syzbot] [net?] WARNING in udp_v6_send_skb 3 (4) 2026/07/31 19:08

Sample crash report:
------------[ cut here ]------------
len >= 65536u
WARNING: ./include/linux/udp.h:49 at udp_set_len_short include/linux/udp.h:49 [inline], CPU#1: syz.2.512/8338
WARNING: ./include/linux/udp.h:49 at udp_v6_send_skb+0xf0f/0x13c0 net/ipv6/udp.c:1388, CPU#1: syz.2.512/8338
Modules linked in:
CPU: 1 UID: 0 PID: 8338 Comm: syz.2.512 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:udp_set_len_short include/linux/udp.h:49 [inline]
RIP: 0010:udp_v6_send_skb+0xf0f/0x13c0 net/ipv6/udp.c:1388
Code: 0b 90 49 8d af ff ff 00 00 48 89 e8 4c 29 f0 41 29 c5 44 89 6c 24 1c 45 8d 7d f8 90 0f 0b 90 e9 4a f2 ff ff e8 f2 b2 89 f7 90 <0f> 0b 90 e9 29 f3 ff ff e8 e4 b2 89 f7 89 de bf 97 ff ff ff e8 48
RSP: 0018:ffffc90003977910 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 000000000001ffb4 RCX: 0000000000000000
RDX: ffff888028e94b00 RSI: ffffffff8a81aede RDI: ffff888028e94b00
RBP: ffff888023f3f780 R08: 0000000000000005 R09: 000000000000ffff
R10: 000000000001ffb4 R11: 0000000000000000 R12: ffff88802429f208
R13: 000000000000200e R14: ffff888023f3f758 R15: 000000000001ffac
FS:  0000000000000000(0000) GS:ffff888096a60000(0063) knlGS:00000000f538bb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007fc2665ea6b0 CR3: 000000002911b000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 udp_v6_push_pending_frames+0x96/0x160 net/ipv6/udp.c:1464
 udpv6_sendmsg+0x1d17/0x2c20 net/ipv6/udp.c:1753
 inet6_sendmsg+0x105/0x140 net/ipv6/af_inet6.c:641
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x36d/0x4e0 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __ia32_sys_sendto+0xdd/0x1b0 net/socket.c:2284
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline]
 __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf6fdefec
Code: Unable to access opcode bytes at 0xf6fdefc2.
RSP: 002b:00000000f538b50c EFLAGS: 00000292 ORIG_RAX: 0000000000000171
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000004010 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/20 13:54 upstream 50d05c7c76c9 853b104b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 WARNING in udp_v6_send_skb
2026/09/08 16:05 net-next 6a41ab891fe8 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in udp_v6_send_skb
2026/09/08 16:05 net-next 6a41ab891fe8 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in udp_v6_send_skb
2026/08/09 23:53 net-next 001b5d347d8b 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in udp_v6_send_skb
2026/08/03 03:00 net-next 69963a0678a3 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in udp_v6_send_skb
2026/08/01 15:36 net-next 69963a0678a3 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in udp_v6_send_skb
2026/07/27 04:10 net-next 04026c998c24 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in udp_v6_send_skb
2026/07/25 16:03 net-next 04026c998c24 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce WARNING in udp_v6_send_skb
* Struck through repros no longer work on HEAD.