Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-89562

CVE-2026-89562: Linux Kernel ip6_gre Header Length Flaw

CVE-2026-89562 is a hardware header length configuration flaw in the Linux kernel ip6_gre implementation that incorrectly handles NBMA tunnel headers. This post explains its technical details, affected versions, impact, and mitigation steps.

Published:

CVE-2026-89562 Overview

CVE-2026-89562 is a Linux kernel vulnerability in the IPv6 Generic Routing Encapsulation (ip6_gre) module. The flaw resides in ip6gre_tnl_link_config_route(), which incorrectly accumulates a lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This behavior is incorrect for both consumers of header_ops: Non-Broadcast Multi-Access (NBMA) ip6gre tunnels and Ethernet-based ip6gretap/ip6erspan devices. The miscalculation corrupts kernel networking state for tunnel devices, creating a local attack surface exploitable by users with the ability to configure network interfaces.

Critical Impact

A local attacker with CAP_NET_ADMIN privileges can trigger memory corruption or denial-of-service conditions in the IPv6 GRE tunnel subsystem, impacting confidentiality, integrity, and availability of the host system.

Affected Products

  • Linux kernel branches containing the ip6_gre NBMA tunnel code path prior to the fix commits
  • Distributions shipping vulnerable stable kernels referenced in the upstream fix set
  • Systems configuring ip6gre, ip6gretap, or ip6erspan tunnel interfaces

Discovery Timeline

  • 2026-09-11 - CVE-2026-89562 published to NVD
  • 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89562

Vulnerability Analysis

The defect lives in the IPv6 GRE tunnel configuration logic in the Linux kernel networking stack. ip6gre_tnl_link_config_route() adjusts the tunnel device's hard_header_len field based on the lower (underlying) device's hardware header length whenever header_ops is set on the tunnel. This adjustment is applied unconditionally to both NBMA ip6gre devices and to ip6gretap/ip6erspan devices, despite their differing header semantics.

For ip6gretap and ip6erspan, the tunnel encapsulates traffic with a fixed Ethernet header, so the hardware header length is constant and should not incorporate the lower device's headroom. For NBMA ip6gre tunnels, the ip6gre_header() routine builds only the GRE header, an optional Foo-over-UDP (FOU) or Generic UDP Encapsulation (GUE) header, and the outer IPv6 header. The lower device's header is required as needed_headroom, not as part of the tunnel's own hardware header.

Root Cause

The root cause is an incorrect field assignment in ip6gre_tnl_link_config_route(). The routine treats the lower device's L2 header size as part of the tunnel's hard_header_len, conflating headroom accounting with hardware header length. This misaccounting can produce inconsistent header length assumptions between packet transmit paths and socket layer callers, leading to memory safety violations or misbehavior during packet construction.

Attack Vector

Exploitation requires local access with privileges sufficient to create or reconfigure network tunnel interfaces (typically CAP_NET_ADMIN in the affected namespace). An attacker configures an ip6gre NBMA tunnel or an ip6gretap/ip6erspan interface over a lower device whose hardware header length inflates hard_header_len. Subsequent packet transmission through the tunnel exercises the miscomputed header length, producing memory corruption, out-of-bounds access, or kernel crashes.

No verified public exploit code is available. Refer to the upstream fix commits for technical detail: Kernel Git Commit c3457a5aae, Kernel Git Commit 7719f6e7ed, and Kernel Git Commit b1e95e3602.

Detection Methods for CVE-2026-89562

Indicators of Compromise

  • Unexpected kernel oops or panic messages referencing ip6_gre, ip6gre_header, or ip6gre_tnl_link_config_route in dmesg or /var/log/kern.log
  • Creation of ip6gre, ip6gretap, or ip6erspan interfaces by non-administrative workflows or unprivileged containers granted CAP_NET_ADMIN
  • Abnormal transmit failures or SKB (socket buffer) length errors originating from GRE tunnel interfaces

Detection Strategies

  • Audit installed kernel versions against the stable trees patched by commits c3457a5aae, 7719f6e7ed, b1e95e3602, 505b6d296c, 565038b009, 8bfe746afee, b8282668d8f, and cb1afd087ae.
  • Monitor ip link add type ip6gre, ip6gretap, and ip6erspan command execution through auditd or eBPF-based process telemetry.
  • Correlate tunnel creation events with subsequent kernel warnings involving header length or headroom fields.

Monitoring Recommendations

  • Enable kernel address sanitizer (KASAN) builds in test environments to surface out-of-bounds accesses in the GRE code paths.
  • Aggregate kernel logs centrally and alert on WARN_ON or BUG messages emitted from net/ipv6/ip6_gre.c.
  • Track allocation of CAP_NET_ADMIN inside user namespaces and containers where network tunnel primitives are reachable.

How to Mitigate CVE-2026-89562

Immediate Actions Required

  • Apply the upstream kernel patches from the stable trees referenced in the fix commits, or upgrade to a distribution kernel that includes them.
  • Restrict CAP_NET_ADMIN in user namespaces and container runtimes to prevent unprivileged tunnel configuration.
  • Inventory hosts that create ip6gre, ip6gretap, or ip6erspan interfaces and prioritize patching those systems.

Patch Information

The fix keeps the lower device header in needed_headroom and sets hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, leaving the fixed Ethernet header length unchanged for tap and erspan devices. Patches are available in the following stable commits: 505b6d296c, 565038b009, 7719f6e7ed, 8bfe746afee, b1e95e3602, b8282668d8f, c3457a5aae, and cb1afd087ae.

Workarounds

  • Blacklist the ip6_gre kernel module on systems that do not require IPv6 GRE tunneling.
  • Deny CAP_NET_ADMIN in unprivileged container profiles (for example, via seccomp, AppArmor, or SELinux policy) to block tunnel creation by untrusted workloads.
  • Remove existing ip6gre, ip6gretap, and ip6erspan interfaces on hosts where they are unused.
bash
# Prevent loading of the vulnerable module until the kernel is patched
echo 'blacklist ip6_gre' | sudo tee /etc/modprobe.d/blacklist-ip6gre.conf
echo 'install ip6_gre /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-ip6gre.conf
sudo rmmod ip6_gre 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep ip6_gre

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne