CVE-2026-80615: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80615 Overview

CVE-2026-80615 affects the Linux kernel networking subsystem, specifically the dst_metadata code path used for tunnel metadata handling. The flaw involves a false-positive memcpy overflow warning triggered in skb_tunnel_info_unclone() when the kernel is built with Clang and source fortification enabled. The kmalloc_flex() call in metadata_dst_alloc() sets __counted_by to options_len, which is initialized to zero. A subsequent copy of tunnel information and options triggers a fortified memcpy bounds check because the compiler infers an undersized destination.

Critical Impact
The condition produces a kernel warning and can be reached during geneve_xmit transmission paths, disrupting tunnel networking and impacting availability on affected hosts.

Affected Products

Linux kernel builds that include the net/core/dst_metadata.c tunnel metadata code
Kernels compiled with Clang and CONFIG_FORTIFY_SOURCE
Systems using Geneve and other tunnel drivers that invoke skb_tunnel_info_unclone()

Discovery Timeline

2026-08-28 - CVE-2026-80615 published to the National Vulnerability Database (NVD)
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80615

Vulnerability Analysis

The defect lives in the Linux kernel's tunnel metadata allocator. metadata_dst_alloc() calls kmalloc_flex() to allocate a flexible-array structure and marks the trailing array with __counted_by(options_len). At allocation time options_len is zero, even though the kmalloc request reserves space for the options.

Initialization occurs later, when the caller populates the tunnel info together with its options in a single memcpy. Because __counted_by still reads zero, fortified string helpers evaluate the destination capacity as smaller than the source and abort with a buffer-overflow warning. The reported case shows a 104-byte write into a compiler-visible buffer size of 96 bytes, tripping __fortify_report at lib/string_helpers.c:1036.

The fix splits the initialization into two stages. The main structure and its options_len field are copied first, so __counted_by reflects the correct capacity before the options themselves are written. This preserves the allocation size while satisfying fortify checks. Maintainers considered persisting a non-zero options_len from the allocator or reusing ip_tunnel_info_opts_set(), but rejected both as unsafe or overly heavy for this call site.

Root Cause

The root cause is a mismatch between the compiler's __counted_by view of a flexible array and the actual allocated capacity. The options_len counter is initialized to zero at allocation and only updated during subsequent copy operations, leaving fortified memcpy with an incorrect bound. This is a fortification-level input validation issue rather than a memory-safety bug in the traditional sense.

Attack Vector

The issue is reachable through the network transmit path when tunnel metadata is cloned during Geneve or similar tunnel egress via skb_tunnel_info_unclone() and geneve_xmit(). On kernels built with Clang and CONFIG_FORTIFY_SOURCE, network traffic that exercises tunnel option copying can trigger the fortify warning and terminate the offending operation, degrading tunnel availability.

No verified public exploit code is available. See the upstream patches Kernel Git Commit 4c6d43d and Kernel Git Commit 7ce3173 for the exact source-level changes.

Detection Methods for CVE-2026-80615

Indicators of Compromise

Kernel log messages containing memcpy: detected buffer overflow referencing skb_tunnel_info_unclone or geneve_xmit.
Warnings originating from lib/string_helpers.c:1036 in __fortify_report on hosts using tunnel networking.
Unexpected drops or resets of Geneve, VXLAN, or other metadata-based tunnel flows on Clang-built kernels.

Detection Strategies

Monitor dmesg and journalctl -k for __fortify_report warnings tied to tunnel transmit paths.
Correlate kernel warning bursts with network telemetry showing tunnel packet loss or reset events.
Inventory hosts by kernel build configuration to identify Clang plus CONFIG_FORTIFY_SOURCE targets that are exposed.

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on detected buffer overflow strings.
Track tunnel driver counters (ip -s -s link show) to detect anomalous error rates on geneve, vxlan, and gre interfaces.
Baseline warning volume before and after kernel updates to confirm the patch eliminates the fortify report.

How to Mitigate CVE-2026-80615

Immediate Actions Required

Apply the stable kernel updates that include the two-stage copy fix in tun_dst_unclone and metadata_dst_alloc().
Prioritize patching hosts running Clang-built kernels with CONFIG_FORTIFY_SOURCE enabled and active tunnel workloads.
Restart networking services or reboot after upgrading to ensure the fixed code paths are loaded.

Patch Information

The upstream fix is available in the Linux stable tree as commits 4c6d43db2a4d and 7ce31739fe88. The patches split the tunnel information copy into two stages so options_len is set before the options themselves are written, aligning __counted_by with the allocation. Distribution vendors integrate these commits into their supported stable kernel series.

Workarounds

Rebuild affected kernels with GCC or without CONFIG_FORTIFY_SOURCE where the patch cannot yet be applied, understanding the trade-off in compile-time hardening.
Where feasible, avoid tunnel option configurations that trigger skb_tunnel_info_unclone() on vulnerable hosts until patched kernels are deployed.
Constrain tunnel traffic to hosts running fixed kernels and route sensitive workloads accordingly.

bash

# Verify kernel version and confirm the fix is present
uname -r
grep -E 'CONFIG_FORTIFY_SOURCE|CONFIG_CC_IS_CLANG' /boot/config-$(uname -r)

# Watch for fortify warnings related to the affected path
journalctl -k --since "1 hour ago" | grep -E 'fortify|skb_tunnel_info_unclone|geneve_xmit'