Executive brief
A vulnerability in the Linux kernel's IPv6 tunneling component could allow a local user to cause system instability or a crash. The issue stems from the way the system manages memory buffers for network traffic, which can grow indefinitely without a limit. This could lead to memory exhaustion or data corruption, potentially impacting the availability and security of the affected system.
Technical details
A vulnerability exists in the Linux kernel's IPv6 tunneling implementation (net/ip6_tunnel) where the 'needed_headroom' value for network devices can grow indefinitely without a ceiling. This mirrors a previously fixed issue in the IPv4 tunnel implementation. Without a cap, the headroom adjustment can eventually cause an overflow of header offsets in 'skb_headers_offset_update()' during 'pskb_expand_head()' operations. A local attacker with low privileges could potentially exploit this to cause a denial of service or achieve memory corruption. The fix introduces a maximum allowed headroom cap of 512 bytes, consistent with the IPv4 implementation. Patches have been released across multiple stable kernel branches including 5.4.y, 5.10.y, 5.15.y, and 6.x.
Affected products
- Linux Linux Kernel 4.7 to 6.11.x
Timeline
- 2025-11-12: disclosed: CVE published and advisory released
- 2025-10-29: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/10fe967efe73c610e526ff7460581610633dee9c
- https://git.kernel.org/stable/c/11f6066af3bfb8149aa16c42c0b0c5ea5b199a94
- https://git.kernel.org/stable/c/21f4d45eba0b2dcae5dbc9e5e0ad08735c993f16
- https://git.kernel.org/stable/c/402b6985e872b4cf394bbbf33b503947a326a6cb
- https://git.kernel.org/stable/c/48294a67863c9cfa367abb66bbf0ef6548ae124f
- https://git.kernel.org/stable/c/566f8d5c8a443f2dd69c5460fdec43ed1c870c65
- https://git.kernel.org/stable/c/b6eb25d870f1a8ae571fd3da2244b71df547824b