CVE-2026-80612: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80612 Overview

CVE-2026-80612 is a Linux kernel vulnerability in the lightweight tunnel (LWT) encapsulation subsystem. The flaw resides in the networking stack, specifically in how skb metadata is handled before LWT encapsulation operations. Metadata living in the skb headroom can be silently overwritten or trigger warnings during encapsulation of received packets that still carry XDP-generated metadata. The issue affects packets traversing MPLS, SEG6, IOAM6, ILA, RPL, and BPF LWT xmit encapsulation paths on forwarded traffic. The kernel maintainers resolved the issue by dropping skb metadata inside the three LWT dispatch helpers before invoking the encap operation.

Critical Impact
Forwarded packets carrying XDP metadata can corrupt kernel memory adjacent to skb->data or trigger kernel warnings in skb_data_move(), affecting network stack integrity on systems using LWT encapsulation.

Affected Products

Linux kernel networking subsystem (net/core/lwtunnel.c)
Kernel builds with LWT encapsulation support (MPLS, SEG6, IOAM6, RPL, ILA, SEG6_LOCAL, LWT BPF)
Kernel versions prior to the fix commits 19eec11f3ab5 and c00320b0e355

Discovery Timeline

2026-08-28 - CVE-2026-80612 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80612

Vulnerability Analysis

The defect involves the interaction between XDP-generated skb metadata and LWT encapsulation on forwarded packets. Socket buffer (skb) metadata is designed to pass information between eXpress Data Path (XDP) and Traffic Control (TC) programs. This metadata resides in the skb headroom, immediately before skb->data.

LWT encapsulation prepends outer headers, which moves skb->data back into the headroom where the metadata resides. On received packets forwarded through an LWT path, this triggers one of two failure modes depending on the encapsulation type. Non-BPF LWT encapsulations such as MPLS, SEG6, and IOAM6 call skb_push() and skb_pull(), silently overwriting the metadata. BPF LWT xmit invokes bpf_skb_change_head(), which internally uses skb_data_move() and triggers a WARNING at include/linux/skbuff.h:4609 because the helper expects metadata immediately before skb->data, while forwarded packets place skb->data at the L3 header.

Root Cause

The root cause is a layering mismatch. The IP output path runs LWT xmit before the neighbour output layer builds the outgoing L2 header. For forwarded packets, skb->data points at the L3 header while skb_mac_header() still references the old inbound L2 header. skb_data_move() computes the metadata boundary using skb_mac_header() instead of the true metadata origin, producing incorrect memory operations.

Attack Vector

Exploitation requires network-adjacent traffic reaching a Linux router or forwarding node configured with LWT encapsulation. A remote attacker sending crafted packets to a system with XDP programs attaching metadata and LWT redirect state (LWTUNNEL_STATE_INPUT_REDIRECT, LWTUNNEL_STATE_OUTPUT_REDIRECT, or LWTUNNEL_STATE_XMIT_REDIRECT) can trigger metadata corruption or repeated kernel warnings. Because the code path executes in softirq context during packet processing, no authentication or user interaction is required. The verified fix removes the metadata at three chokepoints: lwtunnel_input(), lwtunnel_output(), and lwtunnel_xmit().

No public proof-of-concept exploit code is available. See the upstream commits 19eec11f3ab5 and c00320b0e355 for the technical resolution.

Detection Methods for CVE-2026-80612

Indicators of Compromise

Kernel log entries containing WARNING: CPU: ... at include/linux/skbuff.h:4609 skb_data_move+0x47/0x90 during packet forwarding.
Call traces referencing bpf_skb_change_head, run_lwt_bpf, bpf_xmit, and lwtunnel_xmit in softirq context.
Unexpected drops or malformed encapsulated packets on nodes running SEG6, MPLS, or IOAM6 tunnels alongside XDP programs.

Detection Strategies

Monitor kernel ring buffer output (dmesg, journalctl -k) for repeated skb_data_move warnings on forwarding hosts.
Audit systems for concurrent XDP metadata producers and LWT encapsulation consumers using ip -d link show and bpftool net show.
Correlate kernel warning bursts with network throughput anomalies on affected forwarding paths.

Monitoring Recommendations

Ingest kernel logs from Linux forwarders and routers into a central log platform and alert on skb_data_move and lwtunnel_xmit warning signatures.
Track kernel build versions across the fleet and flag hosts running versions prior to the upstream fix commits.
Baseline forwarding packet rates on LWT-enabled hosts to detect softirq stalls caused by repeated warning traces.

How to Mitigate CVE-2026-80612

Immediate Actions Required

Identify Linux hosts using LWT encapsulation (MPLS, SEG6, IOAM6, RPL, ILA, LWT BPF) with ip route show and ip -6 route show.
Apply the upstream kernel patches from commits 19eec11f3ab5 and c00320b0e355 or upgrade to a stable release containing the fix.
Prioritize patching on packet forwarders, SRv6 routers, and nodes running XDP programs that populate data_meta.

Patch Information

The fix drops skb metadata inside lwtunnel_input(), lwtunnel_output(), and lwtunnel_xmit() immediately before the encap operation runs. This single chokepoint covers every LWT encap type and every LWT redirect mode. Reference the stable tree commits 19eec11f3ab5 and c00320b0e355.

Workarounds

Detach XDP programs that produce data_meta on interfaces feeding LWT-encapsulated forwarding paths until the patch is applied.
Disable LWT encapsulation routes on affected hosts where operationally feasible using ip route del for LWT-enabled destinations.
Restrict untrusted network segments from reaching forwarding nodes that combine XDP metadata with LWT encapsulation.

bash

# Verify running kernel version and check for LWT-enabled routes
uname -r
ip -6 route show | grep -E 'encap (seg6|mpls|ioam6|bpf|rpl|ila)'
ip route show | grep -E 'encap (seg6|mpls|ioam6|bpf|rpl|ila)'

# List XDP programs attached to interfaces
bpftool net show

# After patching, confirm no skb_data_move warnings recur
dmesg -T | grep -i skb_data_move