Executive brief
A vulnerability in the Linux kernel's networking component could allow a remote attacker to cause a system crash (kernel panic). The issue affects systems processing ERSPAN traffic, a protocol used for mirroring network traffic for monitoring purposes. An exploit would result in a complete denial of service for the affected server.
Technical details
A buffer overflow exists in the ERSPAN receive path (erspan_rcv and ip6erspan_rcv) within the Linux kernel. The root cause is the failure to initialize the 'options_len' field before referencing the 'options' flexible array member in 'struct ip_tunnel_info'. When compiled with GCC 15+ and FORTIFY_SOURCE enabled, the compiler's runtime bounds checking detects a zero-size buffer during a memcpy operation, triggering a kernel panic. This can be triggered by remote ERSPAN traffic over GRE tunnels. Patches have been released for affected stable branches.
Affected products
- Linux Linux Kernel 6.15 to 6.18.4
Timeline
- 2025-12-13: other: Patch authored
- 2026-01-14: disclosed: CVE published
- 2026-01-08: patched: Fixed in stable branches