CVE-2026-80612
nicheLinux kernel LWTunnel bug corrupts skb metadata on forwarded encapsulated traffic
CVE-2026-80612 is a data-corruption flaw in the Linux kernel's lightweight tunnel (LWT) encapsulation code: skb metadata, which lives in the skb headroom and is meant for XDP-to-TC communication, is not cleared before LWT encapsulation prepends outer headers, moving skb->data back over the metadata region. When a received, forwarded packet still carrying metadata reaches an encapsulation (MPLS, SEG6, IOAM6, RPL, ILA, or BPF encap) via any of the three LWT redirect modes (input, output, xmit), non-BPF encaps silently overwrite the metadata via skb_push()/skb_pull(), while BPF LWT xmit hits a kernel WARNING in bpf_skb_change_head()/skb_data_move() and has its metadata cleared. An attacker who can route traffic through an affected host could trigger metadata/memory corruption in the headroom, packet mishandling, and kernel warnings; the advisory rates it critical (CVSS 9.8, network-exploitable with no privileges or user interaction). Affected systems are Linux kernels using LWT encapsulation on forwarded IPv6/MPLS traffic in combination with BPF/XDP programs that attach metadata; the flaw was observed on kernel 6.18.21, though no affected or fixed version ranges are stated in the advisory. No public proof-of-concept is known, it is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.4%, so no exploitation is currently known.
What to do: Apply the upstream patch 'net: lwtunnel: Drop skb metadata before LWT encapsulation' as soon as it reaches your stable tree or vendor kernel; do not deploy the trivial alternative of clearing metadata right after TC ingress if you rely on reading metadata at TC egress. Operators using SEG6/SRv6, MPLS, IOAM6 or BPF LWT encapsulation alongside XDP metadata-producing BPF programs should prioritize updating; as an interim mitigation, avoid combining those features on the same forwarding path and watch for the skb_data_move() kernel WARNING on affected hosts.
| Linux kernel (net/lwtunnel — lwtunnel_input, lwtunnel_output, lwtunnel_xmit; affects MPLS, SEG6, IOAM6, RPL, ILA and BPF | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb->data. LWT programs cannot access the __sk_buff->data_meta pseudo-pointer to metadata. However, LWT encapsulation prepends outer headers, moving skb->data back over the headroom where the metadata sits. On an RX-originated (forwarded) packet that still carries XDP metadata this goes wrong in two different ways, depending on the encap type: 1. Non-BPF LWT encaps (mpls, seg6, ioam6 ...) call skb_push()/skb_pull() and silently overwrite the metadata that sits in the headroom. 2) BPF LWT xmit calls bpf_skb_change_head(), which uses skb_data_move(). That helper expects metadata immediately before skb->data. But since the IP output path runs LWT xmit before neighbour output has built the outgoing L2 header, for forwarded packets skb->data points at the L3 header while skb_mac_header() still points at the old L2 header. skb_data_move() sees metadata ending at skb_mac_header(), not before skb->data, warns and clears metadata: WARNING: CPU: 21 PID: 454557 at include/linux/skbuff.h:4609 skb_data_move+0x47/0x90 CPU: 21 UID: 0 PID: 454557 Comm: napi/iconduit-g Tainted: G O 6.18.21 #1 RIP: 0010:skb_data_move+0x47/0x90 Call Trace: bpf_skb_change_head+0xe6/0x1a0 bpf_prog_...+0x213/0x2e3 run_lwt_bpf.isra.0+0x1d3/0x360 bpf_xmit+0x46/0xe0 lwtunnel_xmit+0xa1/0xf0 ip_finish_output2+0x1e7/0x5e0 ip_output+0x63/0x100 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x2b/0x190 net_rx_action+0x40b/0x7f0 handle_softirqs+0xd2/0x270 do_softirq+0x3f/0x60 That is what happens, as for how to fix it - a received packet that carries metadata can reach an encap through any of the three LWT redirect modes: LWTUNNEL_STATE_INPUT_REDIRECT ip6_rcv_finish dst_input lwtunnel_input LWTUNNEL_STATE_OUTPUT_REDIRECT ip6_rcv_finish dst_input ip6_forward ip6_forward_finish dst_output lwtunnel_output LWTUNNEL_STATE_XMIT_REDIRECT ip6_rcv_finish dst_input ip6_forward ip6_forward_finish dst_output ip6_output ip6_finish_output ip6_finish_output2 lwtunnel_xmit Every encap funnels through the three LWT dispatch helpers, so drop the metadata there, right before handing the skb to the encap op. This single chokepoint covers all encap types and all three redirect modes: - lwtunnel_input(): seg6, rpl, ila, seg6_local - lwtunnel_output(): ioam6 - lwtunnel_xmit(): mpls, LWT BPF xmit Alternatively, we could clear the metadata right after TC ingress hook. That would require a compromise, however. Metadata would become inaccessible from TC egress (in setups where it actually reaches the hook it tact, that is without any L2 tunnels on path).
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.