Executive brief
A vulnerability was identified in the Linux kernel's networking component where certain complex network configurations could trigger a kernel warning. While primarily a stability concern, a local user could potentially trigger this warning repeatedly by creating long network forwarding paths, such as those used in IPIP tunnels. This could lead to system log flooding or minor performance degradation, but it does not directly allow for data theft or full system takeover.
Technical details
A vulnerability in `net/core/dev.c` within the Linux kernel involved the `dev_fwd_path` function. The function contained a `WARN_ON_ONCE` assertion that triggered if the number of paths in a `net_device_path_stack` exceeded `NET_DEVICE_PATH_STACK_MAX`. With the introduction of IPIP tunnel support, it became possible for userspace to configure a forwarding path long enough to hit this limit. While the code correctly returns NULL to prevent a buffer overflow, the inclusion of the warning macro allows a local user to trigger a kernel splat. The fix removes the `WARN_ON_ONCE` while maintaining the bounds check to ensure system stability without unnecessary logging.
Affected products
- Linux Linux kernel All versions prior to the February 2026 patches
Timeline
- 2026-02-17: patched: Initial patch authored by Pablo Neira Ayuso
- 2026-05-27: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/008e7a7c293b30bc43e4368dac6ea3808b75a572
- https://git.kernel.org/stable/c/50422613185d505201167e8bdd2f2700790d5db6
- https://git.kernel.org/stable/c/548244c2f542aa0ad49453e9306e715a3877bc44
- https://git.kernel.org/stable/c/9464ca7a6e56ad1ebf48b2ad5c16871edfad10c6
- https://git.kernel.org/stable/c/959ea349c7e2d4edf07b6838ca7e59345fe61a08
- https://git.kernel.org/stable/c/a78d055ba7c31103ad02f8eceb0c452e154d2660
- https://git.kernel.org/stable/c/dcf9b3c90e5560339649d088836529883fb509f3