Medium 5.5Published Jan 13, 2026

CVE-2025-71098ip6_gre: make ip6gre_header() robust

Updated under an hour ago (2026-10-19 07:50 UTC)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: make ip6gre_header() robust Over the years, syzbot found many ways to crash the kernel in ip6gre_header() [1]. This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ip6gre device. [1] skbuff: skb_under_panic: text:ffffffff8a1d69a8 len:136 put:40 head:ffff888059bc7000 data:ffff888059bc6fe8 tail:0x70 end:0x6c0 dev:team0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:213 ! <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline] ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:220 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c12b395a46646bab69089ce7016ac78177f6001f before 17e7386234f740f3e7d5e58a47b5847ea34c3bc2; from c12b395a46646bab69089ce7016ac78177f6001f before 41a1a3140aff295dee8063906f70a514548105e8; from c12b395a46646bab69089ce7016ac78177f6001f before adee129db814474f2f81207bd182bf343832a52e; from c12b395a46646bab69089ce7016ac78177f6001f before 1717357007db150c2d703f13f5695460e960f26c; from c12b395a46646bab69089ce7016ac78177f6001f before 5fe210533e3459197eabfdbf97327dacbdc04d60; from c12b395a46646bab69089ce7016ac78177f6001f before 91a2b25be07ce1a7549ceebbe82017551d2eec92; from c12b395a46646bab69089ce7016ac78177f6001f before db5b4e39c4e63700c68a7e65fc4e1f1375273476	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.7.1 before 5.10.248; from 5.11 before 5.15.198; from 5.16 before 6.1.160; from 6.2 before 6.6.120; from 6.7 before 6.12.64; from 6.13 before 6.18.4; 3.7; 6.19; and 7 more ranges	NVD

References

https://git.kernel.org/stable/c/17e7386234f740f3e7d5e58a47b5847ea34c3bc2patch
https://git.kernel.org/stable/c/41a1a3140aff295dee8063906f70a514548105e8patch
https://git.kernel.org/stable/c/adee129db814474f2f81207bd182bf343832a52epatch
https://git.kernel.org/stable/c/1717357007db150c2d703f13f5695460e960f26cpatch
https://git.kernel.org/stable/c/5fe210533e3459197eabfdbf97327dacbdc04d60patch
https://git.kernel.org/stable/c/91a2b25be07ce1a7549ceebbe82017551d2eec92patch
https://git.kernel.org/stable/c/db5b4e39c4e63700c68a7e65fc4e1f1375273476patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.