CVE-2026-80978

Received Received - Intake

Linux Kernel IP Tunnel Headroom Overflow

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-80978

EUVD

EUVD-2026-76301

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves IP tunnel devices advertising an excessive headroom value. Headroom refers to the extra space reserved in network packet buffers. When multiple user-created tunnel devices stack, the derived headroom can exceed the 16-bit limit of skb header offsets, causing wrap-around during head expansion. The fix caps the advertised headroom at 512 to prevent this issue.

Detection Guidance

This vulnerability may not have direct detection commands as it involves kernel-level behavior with IP tunnel devices. Monitor for kernel logs or crashes related to IP tunnel operations, especially when using stacked tunnel configurations. Check for skb headroom reservation errors or warnings in system logs.

Impact Analysis

This vulnerability may cause network packet processing failures or crashes in systems using IP tunnels. It could lead to unexpected behavior, reduced performance, or denial-of-service conditions if exploited through crafted tunnel configurations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel issue related to IP tunnel headroom management, which does not involve data privacy, security controls, or regulatory requirements.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve this issue. Avoid creating deeply nested or stacked IP tunnel configurations that could lead to excessive headroom requirements. Review tunnel device configurations to ensure they do not exceed safe headroom limits.

Hi! I’m here to help you understand CVE-2026-80978. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70