CVE-2026-89562

Received Received - Intake

ip6_gre Tunnel Header Length Miscalculation in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops. ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. The lower device header is headroom needed later, not part of the tunnel device's hardware header. Keep the lower device header in needed_headroom. Set hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, and leave the fixed Ethernet header length unchanged for tap and erspan devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89562

EUVD

EUVD-2026-76473

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of hardware header length for NBMA (Non-Broadcast Multi-Access) tunnels in the ip6_gre module. The issue occurs when ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len when header_ops is set. This is problematic because ip6gretap and ip6erspan have fixed Ethernet hardware header lengths, and the lower device header should only be part of the headroom, not the tunnel device's hardware header.

Detection Guidance

This vulnerability is specific to Linux kernel networking components related to ip6_gre tunnels. Detection requires checking kernel version and tunnel configurations. Inspect active ip6gre tunnels with commands like 'ip -6 tunnel show' or 'ip link show type ip6gre'. Verify kernel logs for errors related to hardware header length mismatches in GRE tunnels.

Impact Analysis

This vulnerability could lead to network misconfigurations or packet handling issues in systems using ip6gre tunnels. It may cause incorrect header length calculations, potentially resulting in packet drops, performance degradation, or connectivity problems for tunnel interfaces.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a Linux kernel networking issue involving hardware header length in IP6GRE tunnels. No evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. If updating is not immediately possible, avoid using ip6gre tunnels with NBMA configurations until patched. Monitor network performance and logs for tunnel-related errors as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-89562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70