Executive brief
The Linux kernel's BPF lightweight tunnel module has a buffer management flaw where it may drop network packets unexpectedly. When BPF programs modify packet headers during transmission, the kernel fails to validate that sufficient space remains for Ethernet hardware headers, causing packets to be silently dropped and disrupting network connectivity.
Technical details
The vulnerability is a buffer headroom validation error in net/core/lwt_bpf.c. When an LWT_XMIT BPF program modifies an skb (socket buffer) and returns BPF_OK, the bpf_xmit() function rechecks remaining headroom using hard_header_len (14 bytes on Ethernet). However, the neighbour output path (neigh_hh_output) requires aligned space—16 bytes (HH_DATA_ALIGN) for cached hardware headers. If a BPF program calls bpf_skb_change_head(skb, 1, 0), the validation incorrectly accepts 15 bytes of headroom, but neigh_hh_output later drops the packet due to insufficient aligned space. The fix changes the post-BPF headroom check to use LL_RESERVED_SPACE(dst->dev) instead of hard_header_len, matching the reservation made before LWT transmission. This is a local denial-of-service affecting systems using BPF-based lightweight tunnels.
Affected products
- Linux Linux kernel 4.x, 5.x, 6.x (all versions prior to patching)
Timeline
- 2026-09-17: disclosed: CVE-2026-90160 published
- 2026-08-17: patched: Upstream patch 5fe7007aed9ad069b2bd77e5d0c875c64f5c0269 committed
- 2026-09-14: other: Stable tree patch 179a5b2171573d94a25c9aa8e1c9f9ac352ad316 committed