Executive brief
The Linux kernel's network tunneling layer (LWT) improperly handles metadata attached to network packets during forwarding, allowing it to be overwritten or exposed. This affects systems performing packet encapsulation for tunneling or traffic management, potentially leading to information disclosure or packet mishandling on forwarded traffic.
Technical details
The vulnerability exists in the Lightweight Tunneling (LWT) encapsulation path where skb (socket buffer) metadata—used for XDP/TC inter-layer communication—sits in the skb headroom immediately before skb->data. When LWT encaps prepend outer headers, they move skb->data backward into the headroom, overwriting metadata. Non-BPF LWT encaps (mpls, seg6, ioam6) silently corrupt metadata via skb_push/pull, while BPF LWT xmit triggers unsafe skb_data_move() operations and clears metadata with warnings. The fix drops metadata at three LWT dispatch chokepoints (lwtunnel_input, lwtunnel_output, lwtunnel_xmit) before handing packets to encap operations, covering all encap types and redirect modes. Forwarded packets with existing XDP metadata are the primary attack surface; no user authentication is required.
Affected products
- Linux Linux kernel affected versions prior to fix (exact version not specified in advisory)
Timeline
- 2026-08-28: disclosed