CVE-2026-89562

A flaw in the Linux kernel's IPv6 GRE tunneling code causes ip6gre_tnl_link_config_route() to wrongly fold the lower (underlying) device's hardware header length into the tunnel device's hard_header_len whenever header_ops is set. This mis-sizes the headroom reserved for outgoing packets on NBMA ip6gre tunnels and incorrectly inflates hard_header_len on ip6gretap and ip6erspan devices, which have a fixed Ethernet header length, potentially leading to kernel memory corruption during packet transmission. A local attacker with low privileges on an affected host who can influence tunnel packet paths could leverage this for a system crash (denial of service) or, at worst, privilege escalation, consistent with the high local-vector CVSS 7.8 rating. Affected systems are those running kernels containing this ip6_gre code, primarily servers, routers, and gateways configured with ip6gre, ip6gretap, or ip6erspan tunnels. No public proof of concept is known and the issue is not listed in CISA's KEV catalog, so exploitation status is none known.

What to do: Patch to a kernel release containing this ip6_gre fix as soon as your distribution ships it. Audit hosts for ip6gre, ip6gretap, or ip6erspan tunnel configurations, especially NBMA setups over lower devices with header_ops set, since those are where the mis-sized hardware header is triggered. As an interim measure, unprivileged local users should not be able to create or manipulate tunnel devices (restrict CAP_NET_ADMIN) on unpatched systems.