CVE-2026-80978

net: cap advertised IP tunnel headroom

State: Published
Severity: 7.8 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: cap advertised IP tunnel headroom

IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets.

The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device.

Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before fb889a619723032140f5d983a3a34d25a5a2bed4Affected 1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before b160422f8103574425e2834130e169d84c94fa1dAffected 1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before d36e75f5669140b66515ad3a176ca6337bd80a5eAffected 1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before 84783961cb8bdb36b4f41a02ce43aafc6d52b176Affected 1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before bc4e05ae66c9797a0972ac44326e69c5305e0020Affected 1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before af0ee8f04bea22cdb331fa3509e17f81b48938adAffected 1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before 9144f2c53a04465a6878172b523f640313c5559eAffected 1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before 6b222adeb9340306e2ff97127c76117abb9b3df8Affected
LinuxLinux	3.11Affected before 3.11Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before fb889a619723032140f5d983a3a34d25a5a2bed4Affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before b160422f8103574425e2834130e169d84c94fa1dAffected
1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before d36e75f5669140b66515ad3a176ca6337bd80a5eAffected
1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before 84783961cb8bdb36b4f41a02ce43aafc6d52b176Affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before bc4e05ae66c9797a0972ac44326e69c5305e0020Affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before af0ee8f04bea22cdb331fa3509e17f81b48938adAffected
1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before 9144f2c53a04465a6878172b523f640313c5559eAffected
1a37e412a0225fcba5587f24c0dfc7636efc8b69 to before 6b222adeb9340306e2ff97127c76117abb9b3df8Affected

LinuxLinux

3.11Affected
before 3.11Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.