{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80978", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.811Z", "datePublished": "2026-09-11T19:42:39.496Z", "dateUpdated": "2026-09-13T06:28:44.249Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-13T06:28:44.249Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cap advertised IP tunnel headroom\n\nIP tunnel devices derive their advertised needed_headroom from lower\noutput devices. A stack of user-created devices can make the derived\nvalue larger than the 16-bit skb header offsets can represent. Once IP\noutput reserves it, skb head expansion can wrap those offsets.\n\nThe runtime transmit path already caps a growing needed_headroom at 512.\nApply the same cap when tunnel configuration publishes needed_headroom\nderived from a lower output device.\n\nCapping the advertised value is safe: IP tunnel transmit still expands\nthe skb when a packet needs more headroom. A nonsensical stacked\nconfiguration can therefore incur an extra reallocation, but it cannot\npublish an unbounded reservation to upper layers."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Triggering the wrap requires locally creating a namespace stack of IP tunnel devices (ipip/gre/sit/ip6tnl via rtnetlink or SIOCADDTUNNEL) so bind/link-config can copy an uncapped needed_headroom, then sending packets through that stack. A remote peer cannot build that topology, so the attacker-controlled path is local.\nAC:L - The attacker fully controls tunnel creation, IFLA_IPTUN_LINK/parms.link stacking (or a netkit lower device with a large IFLA_NETKIT_HEADROOM), and the subsequent transmit. Each bind copies lower needed_headroom plus t_hlen until LL_RESERVED_SPACE exceeds 16-bit skb offsets; no race or uninfluenced victim state is required.\nPR:L - Creating and binding these tunnels needs CAP_NET_ADMIN, but rtnetlink uses netlink_ns_capable()/sk_ns_capable() against net->user_ns and ip_tunnel_ctl uses ns_capable(net->user_ns, CAP_NET_ADMIN), so an unprivileged user obtains it with unshare -Urn. Fallback tunl0/ip6tnl0 devices are created in every netns by default.\nUI:N - The attacker creates the stacked tunnels and generates the traffic that drives IP output/skb_cow_head; no other user or administrator action is required.\nS:U - The resulting skb header-offset wrap corrupts kernel heap in the same OS security authority. This is standard in-kernel privilege escalation, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - After pskb_expand_head adds a >64K nhead, u16 network_header wraps so skb->data points outside skb->head. Neighbour/flow-dissect paths then __skb_pull/read with a negative offset, producing the same unbounded KASAN use-after-free/OOB read as CVE-2024-26804/CVE-2025-40173.\nI:H - Post-wrap, skb_push/dev_hard_header and iptunnel_xmit/ip6_tnl_xmit write outer IP/GRE headers at the corrupted skb->data, giving an out-of-bounds write into unrelated kernel heap that can be used for control-flow hijacking.\nA:H - The wrapped offsets and subsequent out-of-bounds accesses reliably oops/panic (KASAN, skb_under_panic, or unmapped dereference), matching the confirmed crash impact of the earlier unbounded tunnel-headroom bugs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/ip_tunnels.h", "net/ipv4/ip_tunnel.c", "net/ipv6/ip6_gre.c", "net/ipv6/ip6_tunnel.c", "net/ipv6/sit.c"], "versions": [{"version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69", "lessThan": "bc4e05ae66c9797a0972ac44326e69c5305e0020", "status": "affected", "versionType": "git"}, {"version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69", "lessThan": "af0ee8f04bea22cdb331fa3509e17f81b48938ad", "status": "affected", "versionType": "git"}, {"version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69", "lessThan": "9144f2c53a04465a6878172b523f640313c5559e", "status": "affected", "versionType": "git"}, {"version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69", "lessThan": "6b222adeb9340306e2ff97127c76117abb9b3df8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/ip_tunnels.h", "net/ipv4/ip_tunnel.c", "net/ipv6/ip6_gre.c", "net/ipv6/ip6_tunnel.c", "net/ipv6/sit.c"], "versions": [{"version": "3.11", "status": "affected"}, {"version": "0", "lessThan": "3.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.11", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020"}, {"url": "https://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad"}, {"url": "https://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e"}, {"url": "https://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8"}], "title": "net: cap advertised IP tunnel headroom", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/ip_tunnels.h", "net/ipv4/ip_tunnel.c", "net/ipv6/ip6_gre.c", "net/ipv6/ip6_tunnel.c", "net/ipv6/sit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bc4e05ae66c9797a0972ac44326e69c5305e0020", "status": "affected", "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69", "versionType": "git"}, {"lessThan": "af0ee8f04bea22cdb331fa3509e17f81b48938ad", "status": "affected", "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69", "versionType": "git"}, {"lessThan": "9144f2c53a04465a6878172b523f640313c5559e", "status": "affected", "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69", "versionType": "git"}, {"lessThan": "6b222adeb9340306e2ff97127c76117abb9b3df8", "status": "affected", "version": "1a37e412a0225fcba5587f24c0dfc7636efc8b69", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/ip_tunnels.h", "net/ipv4/ip_tunnel.c", "net/ipv6/ip6_gre.c", "net/ipv6/ip6_tunnel.c", "net/ipv6/sit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.11"}, {"lessThan": "3.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cap advertised IP tunnel headroom\n\nIP tunnel devices derive their advertised needed_headroom from lower\noutput devices. A stack of user-created devices can make the derived\nvalue larger than the 16-bit skb header offsets can represent. Once IP\noutput reserves it, skb head expansion can wrap those offsets.\n\nThe runtime transmit path already caps a growing needed_headroom at 512.\nApply the same cap when tunnel configuration publishes needed_headroom\nderived from a lower output device.\n\nCapping the advertised value is safe: IP tunnel transmit still expands\nthe skb when a packet needs more headroom. A nonsensical stacked\nconfiguration can therefore incur an extra reallocation, but it cannot\npublish an unbounded reservation to upper layers."}], "id": "CVE-2026-80978", "lastModified": "2026-09-13T07:17:04.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:04.143", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: IP tunnel headroom miscalculation can lead to network performance degradation", "id": "2532487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532487"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in the Linux kernel, specifically within its IP tunnel devices. A local attacker could create a stack of user-controlled IP tunnel devices, causing the system to miscalculate the required memory for network packet headers. This miscalculation can lead to unnecessary memory reallocations during packet transmission, which may result in performance degradation for network operations."], "name": "CVE-2026-80978", "public_date": "2026-09-11T19:42:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80978\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80978\nhttps://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8\nhttps://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e\nhttps://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad\nhttps://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1a37e412a0225fcba5587f24c0dfc7636efc8b69,bc4e05ae66c9797a0972ac44326e69c5305e0020)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1a37e412a0225fcba5587f24c0dfc7636efc8b69,af0ee8f04bea22cdb331fa3509e17f81b48938ad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1a37e412a0225fcba5587f24c0dfc7636efc8b69,9144f2c53a04465a6878172b523f640313c5559e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1a37e412a0225fcba5587f24c0dfc7636efc8b69,6b222adeb9340306e2ff97127c76117abb9b3df8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-13T00:30:16.528627+00:00", "updated": "2026-09-13T00:30:16.528690+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}