Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem related to how it handles IPIP (IP-over-IP) tunnels. The system was incorrectly attempting to use hardware acceleration for these tunnels even though no drivers currently support it, which could lead to unexpected system behavior or instability. This issue has been resolved by ensuring the system recognizes these unsupported configurations early and avoids invalid hardware offload attempts.
Technical details
A vulnerability in the Linux kernel's netfilter flowtable infrastructure was identified where IPIP tunnel hardware offload was attempted despite a lack of driver support. The root cause was the absence of a check for unsupported tunnel configurations before enqueuing offload work to the worker thread. This could lead to invalid state transitions or resource mismanagement when the hardware offload configuration is ignored after being queued. The fix introduces a stub to check for unsupported configurations (nf_flow_offload_unsupported) and ensures the NF_FLOW_HW flag is only set if the configuration is valid, preventing repeated failed offload attempts during flow refreshes. Patches have been applied to stable kernel branches including 6.19 and 7.1.4.
Affected products
- Linux Linux Kernel 6.19, 7.1.4, 7.2-rc3
Timeline
- 2026-06-30: other: Patch authored by Pablo Neira Ayuso
- 2026-07-25: advisory: CVE-2026-64410 published by NVD