Executive brief
The Linux kernel's ipvlan virtual network driver failed to properly inherit packet buffer space requirements from underlying network interfaces. This caused packet processing to allocate insufficient memory, leading to data corruption (buffer underflows) or system crashes when packets traversed security or tunneling layers that require additional header and trailer space.
Technical details
The vulnerability is a memory safety issue in the ipvlan driver (drivers/net/ipvlan/ipvlan_main.c). During device initialization and feature updates, ipvlan devices did not inherit the needed_headroom and needed_tailroom attributes from their physical device, even though they inherited hard_header_len. When lower network layers (e.g., macsec, ipsec, wireguard, tunnels, or veth) require extra buffer space for headers or trailers, upper layers cannot calculate correct packet sizes, resulting in insufficient socket buffer allocation. This causes skb headroom underflows and KASAN-detectable heap-use-after-free crashes during dev_hard_header() or ipvlan_hard_header() operations. The fix propagates these attributes during ipvlan_init() and on NETDEV_FEAT_CHANGE events. No network access, authentication, or user interaction is required; local processes using ipvlan interfaces are affected.
Affected products
- Linux Linux kernel multiple versions (fix backported to 2.6.11 through 7.2)
Timeline
- 2026-08-26: disclosed
- 2026-08-06: patched: Upstream commit e16e960d55a40d36bd7c2494cc005e757dc9a1ef