CVE-2026-80978net: cap advertised IP tunnel headroom
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1a37e412a0225fcba5587f24c0dfc7636efc8b69 before fb889a619723032140f5d983a3a34d25a5a2bed4; from 1a37e412a0225fcba5587f24c0dfc7636efc8b69 before b160422f8103574425e2834130e169d84c94fa1d; from 1a37e412a0225fcba5587f24c0dfc7636efc8b69 before d36e75f5669140b66515ad3a176ca6337bd80a5e; from 1a37e412a0225fcba5587f24c0dfc7636efc8b69 before 84783961cb8bdb36b4f41a02ce43aafc6d52b176; from 1a37e412a0225fcba5587f24c0dfc7636efc8b69 before bc4e05ae66c9797a0972ac44326e69c5305e0020; from 1a37e412a0225fcba5587f24c0dfc7636efc8b69 before af0ee8f04bea22cdb331fa3509e17f81b48938ad; from 1a37e412a0225fcba5587f24c0dfc7636efc8b69 before 9144f2c53a04465a6878172b523f640313c5559e; from 1a37e412a0225fcba5587f24c0dfc7636efc8b69 before 6b222adeb9340306e2ff97127c76117abb9b3df8 | CNA record |
References
- https://git.kernel.org/stable/c/fb889a619723032140f5d983a3a34d25a5a2bed4
- https://git.kernel.org/stable/c/b160422f8103574425e2834130e169d84c94fa1d
- https://git.kernel.org/stable/c/d36e75f5669140b66515ad3a176ca6337bd80a5e
- https://git.kernel.org/stable/c/84783961cb8bdb36b4f41a02ce43aafc6d52b176
- https://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020
- https://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad
- https://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e
- https://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.