CVE-2026-45847: Linux Kernel Forward Path Vulnerability

CVE-2026-45847 Overview

CVE-2026-45847 affects the Linux kernel networking subsystem. The issue stems from a WARN_ON_ONCE triggered when userspace constructs a sufficiently long forward path. Recent support for IP-in-IP (IPIP) tunnels increases the likelihood of reaching the warning condition. Maintainers resolved the issue by removing the WARN_ON_ONCE when accessing the forward path array.

The vulnerability is tracked across multiple stable kernel branches, with fixes applied through a series of kernel commits. The EPSS score is 0.024% with a percentile of 7.377, indicating low exploitation likelihood.

Critical Impact
A local user can trigger a kernel warning by constructing an oversized network forward path, potentially producing log noise or, in panic_on_warn configurations, a denial of service condition.

Affected Products

Linux kernel networking stack with IPIP tunnel support enabled
Stable kernel branches receiving the referenced patch commits
Distributions shipping kernels prior to the upstream fix

Discovery Timeline

2026-05-27 - CVE-2026-45847 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45847

Vulnerability Analysis

The Linux kernel maintains a forward path array used to track the chain of network devices a packet traverses. The networking code includes a WARN_ON_ONCE macro intended to flag unexpected conditions when accessing this array. With the addition of IPIP tunnel support, the forward path can legitimately grow longer than the prior implementation anticipated.

When userspace configures an interface topology that produces a sufficiently deep forward path, the WARN_ON_ONCE triggers. This emits a kernel stack trace to the system log. Systems configured with panic_on_warn will halt on this condition, producing a denial of service.

The fix removes the WARN_ON_ONCE because the previously unexpected condition is now reachable through legitimate IPIP tunnel configurations.

Root Cause

The root cause is an outdated invariant assumption in the networking forward path code. The WARN_ON_ONCE check assumed a maximum forward path length that no longer reflects supported tunnel topologies. The assertion was correct for the original networking topology assumptions but became stale once IPIP tunnel support extended forwarding chain depth.

Attack Vector

A local user with sufficient privileges to configure network interfaces can chain tunnels to produce a long forward path. Packet forwarding through this chain reaches the array access path that triggers the warning. The vulnerability requires local access and network configuration capabilities, limiting practical exploitation.

The full patch series is available across multiple stable kernel branches. See the Kernel Commit Change for the primary fix.

Detection Methods for CVE-2026-45847

Indicators of Compromise

Kernel log entries containing WARN_ON_ONCE stack traces referencing the network forward path code
Unexpected kernel panics on systems with panic_on_warn enabled following network configuration changes
Creation of unusually deep IPIP tunnel chains in interface configuration

Detection Strategies

Monitor dmesg and /var/log/kern.log for WARN_ON_ONCE traces tied to forward path array access
Audit network configuration changes that introduce stacked IPIP tunnels
Correlate kernel warning events with the originating user namespace or container

Monitoring Recommendations

Forward kernel logs to a centralized logging platform for retention and search
Alert on panic_on_warn triggered reboots that follow ip link or tunnel creation activity
Track package versions of installed kernels against vendor advisories referencing the patch commits

How to Mitigate CVE-2026-45847

Immediate Actions Required

Update to a kernel release that includes the upstream fix from the referenced stable commits
Restrict CAP_NET_ADMIN to trusted users and limit network namespace creation for untrusted workloads
Review systems running with panic_on_warn and assess exposure to log-driven denial of service

Patch Information

The Linux kernel maintainers resolved the issue by removing the WARN_ON_ONCE from the forward path array access code. The fix is distributed across multiple stable branches through commits including 008e7a7c293b, 50422613185d, 548244c2f542, 9464ca7a6e56, 959ea349c7e2, a78d055ba7c3, and dcf9b3c90e55. Refer to the Kernel Commit Change entries for the corresponding stable trees.

Workarounds

Disable IPIP tunnel module loading where the functionality is not required using module blacklisting
Avoid enabling panic_on_warn on production systems exposed to untrusted local users
Limit configuration of stacked tunnels through network management policy

bash

# Configuration example: blacklist the IPIP module where unused
echo "blacklist ipip" | sudo tee /etc/modprobe.d/blacklist-ipip.conf
sudo update-initramfs -u

# Verify panic_on_warn is disabled on exposed systems
sysctl kernel.panic_on_warn
# Set to 0 if not required
sudo sysctl -w kernel.panic_on_warn=0