7.8

CVE-2026-80978

net: cap advertised IP tunnel headroom

In the Linux kernel, the following vulnerability has been resolved:

net: cap advertised IP tunnel headroom

IP tunnel devices derive their advertised needed_headroom from lower
output devices. A stack of user-created devices can make the derived
value larger than the 16-bit skb header offsets can represent. Once IP
output reserves it, skb head expansion can wrap those offsets.

The runtime transmit path already caps a growing needed_headroom at 512.
Apply the same cap when tunnel configuration publishes needed_headroom
derived from a lower output device.

Capping the advertised value is safe: IP tunnel transmit still expands
the skb when a packet needs more headroom. A nonsensical stacked
configuration can therefore incur an extra reallocation, but it cannot
publish an unbounded reservation to upper layers.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 1a37e412a0225fcba5587f24c0dfc7636efc8b69
Version < fb889a619723032140f5d983a3a34d25a5a2bed4
Status affected
Version 1a37e412a0225fcba5587f24c0dfc7636efc8b69
Version < b160422f8103574425e2834130e169d84c94fa1d
Status affected
Version 1a37e412a0225fcba5587f24c0dfc7636efc8b69
Version < d36e75f5669140b66515ad3a176ca6337bd80a5e
Status affected
Version 1a37e412a0225fcba5587f24c0dfc7636efc8b69
Version < 84783961cb8bdb36b4f41a02ce43aafc6d52b176
Status affected
Version 1a37e412a0225fcba5587f24c0dfc7636efc8b69
Version < bc4e05ae66c9797a0972ac44326e69c5305e0020
Status affected
Version 1a37e412a0225fcba5587f24c0dfc7636efc8b69
Version < af0ee8f04bea22cdb331fa3509e17f81b48938ad
Status affected
Version 1a37e412a0225fcba5587f24c0dfc7636efc8b69
Version < 9144f2c53a04465a6878172b523f640313c5559e
Status affected
Version 1a37e412a0225fcba5587f24c0dfc7636efc8b69
Version < 6b222adeb9340306e2ff97127c76117abb9b3df8
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.11
Status affected
Version 0
Version < 3.11
Status unaffected
Version <= 5.10.*
Version 5.10.270
Status unaffected
Version <= 5.15.*
Version 5.15.221
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.109
Status unaffected
Version <= 6.18.*
Version 6.18.50
Status unaffected
Version <= 7.2.*
Version 7.2.4
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.028
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020
https://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad
https://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e
https://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8
https://git.kernel.org/stable/c/84783961cb8bdb36b4f41a02ce43aafc6d52b176
https://git.kernel.org/stable/c/b160422f8103574425e2834130e169d84c94fa1d
https://git.kernel.org/stable/c/d36e75f5669140b66515ad3a176ca6337bd80a5e
https://git.kernel.org/stable/c/fb889a619723032140f5d983a3a34d25a5a2bed4