CVE-2026-80978 Overview
CVE-2026-80978 is a Linux kernel vulnerability in the IP tunnel networking subsystem. IP tunnel devices derive their advertised needed_headroom value from lower output devices. Stacking user-created tunnel devices can produce a derived value larger than the 16-bit skb header offsets can represent. Once the IP output path reserves this size, skb head expansion can wrap those offsets, corrupting kernel socket buffer metadata.
The fix caps the advertised needed_headroom at 512 bytes during tunnel configuration, matching the existing runtime transmit-path cap. This prevents unbounded reservations from propagating to upper layers.
Critical Impact
A local user with the ability to create stacked tunnel interfaces can trigger 16-bit offset wraparound in skb head expansion, leading to kernel memory corruption with potential impact on confidentiality, integrity, and availability.
Affected Products
- Linux kernel (upstream) — IP tunnel networking subsystem
- Distributions shipping affected kernel versions prior to the referenced stable commits
- Systems permitting user-created stacked tunnel device configurations
Discovery Timeline
- 2026-09-11 - CVE-2026-80978 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80978
Vulnerability Analysis
The vulnerability resides in the Linux kernel networking code that manages IP tunnel devices. When a tunnel device is created, it advertises a needed_headroom value to upper layers so that transmitted packets reserve sufficient space for encapsulation headers. This advertised value is inherited from the underlying output device.
When users chain multiple tunnel devices on top of each other, each layer adds its own headroom requirement. Because socket buffer (skb) header offsets are stored in 16-bit fields, the accumulated headroom can exceed the representable range. The IP output path then reserves this oversized value, and subsequent skb head expansion arithmetic can wrap the 16-bit offsets, producing invalid pointers into kernel memory.
Exploitation results in kernel-side memory corruption. The fix applies the existing 512-byte transmit-path cap at configuration time. Tunnel transmit still expands the skb on demand when packets need additional headroom, so functional behavior is preserved.
Root Cause
The root cause is an integer overflow condition in the propagation of needed_headroom between stacked IP tunnel devices. Values derived from lower devices were not bounded before publication to upper layers, allowing them to exceed the 16-bit skb offset range.
Attack Vector
Exploitation requires local access with privileges sufficient to create and stack network tunnel devices. This typically requires CAP_NET_ADMIN, which may be available inside user namespaces on systems that permit unprivileged namespace creation. No user interaction is required. The attack targets kernel memory integrity via crafted tunnel device configurations.
No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
See the upstream fix commits for the exact code change, including Kernel Commit 6b222ade and Kernel Commit 9144f2c5.
Detection Methods for CVE-2026-80978
Indicators of Compromise
- Unexpected creation of stacked tunnel interfaces (ipip, gre, sit, ip6tnl) by non-administrative users or containers
- Kernel log entries referencing skb head expansion failures, corrupted socket buffer offsets, or unexplained oopses in IP tunnel transmit paths
- Processes invoking ip link add type ... in unusual patterns from workloads that do not normally manage networking
Detection Strategies
- Audit netlink RTM_NEWLINK operations that create tunnel devices layered over other tunnel devices
- Monitor syscall telemetry for unshare(CLONE_NEWUSER|CLONE_NEWNET) followed by tunnel device creation from unprivileged contexts
- Compare running kernel versions against the fixed stable releases referenced in the upstream commits
Monitoring Recommendations
- Collect kernel ring buffer logs (dmesg) centrally and alert on tunnel-related warnings, oopses, or skb corruption messages
- Track container and namespace creation events, correlating them with subsequent network configuration changes
- Baseline expected tunnel device topology per host and alert on deviations, especially multi-layer stacks
How to Mitigate CVE-2026-80978
Immediate Actions Required
- Apply the vendor-supplied kernel updates that include the upstream fix commits as soon as they are available for your distribution
- Inventory hosts allowing unprivileged user namespace creation and evaluate whether CAP_NET_ADMIN inside namespaces is required
- Restrict container runtimes and workloads from creating tunnel devices unless explicitly required
Patch Information
The fix is present in multiple upstream stable branches. Relevant commits include Kernel Commit 6b222ade, Kernel Commit 84783961, Kernel Commit 9144f2c5, Kernel Commit af0ee8f0, Kernel Commit b160422f, Kernel Commit bc4e05ae, Kernel Commit d36e75f5, and Kernel Commit fb889a61. Consult your Linux distribution's security advisories to map these commits to distribution-specific package versions.
Workarounds
- Disable unprivileged user namespaces where operationally acceptable by setting kernel.unprivileged_userns_clone = 0 (Debian/Ubuntu) or user.max_user_namespaces = 0 (broader)
- Use Linux Security Modules (seccomp, AppArmor, SELinux) to deny tunnel device creation from untrusted workloads
- Avoid deploying multi-layer tunnel stacks on shared or multi-tenant hosts until patched kernels are installed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.