GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80615 (GCVE-0-2026-80615)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
Summary
In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't fit into the structure, even though the memory for them is actually allocated. memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report skb_tunnel_info_unclone+0x179/0x190 geneve_xmit+0x7fe/0xe00 The issue is triggered when built with clang and source fortification. Fix that by doing the copy in two stages: first - the main data with the options_len, then the options. This way the correct length should be known at the time of the copy. It would be better if the options_len never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with options_len set to a non-zero value from the metadata_dst_alloc(). Another option would be to use ip_tunnel_info_opts_set(), but it is doing too many unnecessary operations for the use case here.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 69050f8d6d075dc01af7a5f2f550a8067510366f , < 7ce31739fe88a558370135db95bbeec1e7ddfc29 (git)
Affected: 69050f8d6d075dc01af7a5f2f550a8067510366f , < 4c6d43db2a4d2cef3921e885cf34798f790d34ea (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/dst_metadata.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ce31739fe88a558370135db95bbeec1e7ddfc29",
              "status": "affected",
              "version": "69050f8d6d075dc01af7a5f2f550a8067510366f",
              "versionType": "git"
            },
            {
              "lessThan": "4c6d43db2a4d2cef3921e885cf34798f790d34ea",
              "status": "affected",
              "version": "69050f8d6d075dc01af7a5f2f550a8067510366f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/dst_metadata.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone\n\nkmalloc_flex() in metadata_dst_alloc() sets __counted_by for the\nstructure to the options_len, which is then initialized to zero.\nLater, we\u0027re initializing the structure by copying the tunnel info\ntogether with the options, and this triggers a warning for a potential\nmemcpy overflow, since the compiler estimates that the options can\u0027t\nfit into the structure, even though the memory for them is actually\nallocated.\n\n memcpy: detected buffer overflow: 104 byte write of buffer size 96\n WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report\n  skb_tunnel_info_unclone+0x179/0x190\n  geneve_xmit+0x7fe/0xe00\n\nThe issue is triggered when built with clang and source fortification.\n\nFix that by doing the copy in two stages: first - the main data with\nthe options_len, then the options.  This way the correct length should\nbe known at the time of the copy.\n\nIt would be better if the options_len never changed after allocation,\nbut the allocation code is a little separate from the initialization\nand it would be awkward and potentially dangerous to return a struct\nwith options_len set to a non-zero value from the metadata_dst_alloc().\n\nAnother option would be to use ip_tunnel_info_opts_set(), but it is\ndoing too many unnecessary operations for the use case here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached from geneve_xmit/vxlan_xmit and OVS dev_fill_metadata_dst during overlay packet transmit; remote peers can inject Geneve/VXLAN UDP traffic with tunnel options that later traverse skb_tunnel_info_unclone() on cloud, Kubernetes, and OpenStack/OVN nodes.\nAC:L - On kernels built with CONFIG_FORTIFY_SOURCE and clang, a remote attacker can deterministically trigger the fortified memcpy check by sending Geneve/VXLAN packets carrying non-zero tunnel options that provoke PMTU handling or OVS egress-metadata cloning; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only that the target host already runs Geneve/VXLAN/OVS overlay netdevs, which is routine in data centers; remote overlay peers and unauthenticated senders whose packets are forwarded through these tunnels need no elevated privileges on the target system.\nUI:N - The fortify warning is triggered automatically during kernel packet transmit or OVS metadata handling with no action required from a local user or administrator beyond normal network operation on an overlay-enabled host.\nS:U - Impact is a kernel fortify WARN/BUG in the host networking stack during tunnel metadata cloning; it does not cross VM, container, or IOMMU security boundaries into another authority domain.\nC:L - No actual out-of-bounds read occurs because fortify halts the memcpy before any real overflow, but __fortify_report() emits a kernel warning and call trace that can disclose limited kernel text/layout information useful for further exploitation.\nI:N - This is a fortify false positive: metadata_dst_alloc() correctly sizes the destination via kmalloc_flex() and fortify aborts before the memcpy executes; there is no memory corruption, arbitrary write, or code-execution primitive.\nA:H - Triggering the fortify check calls __fortify_panic(), which issues WARN then BUG(), causing a kernel oops/panic and immediate denial of service on overlay hosts processing malicious Geneve/VXLAN tunnel-metadata traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:24.054Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ce31739fe88a558370135db95bbeec1e7ddfc29"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c6d43db2a4d2cef3921e885cf34798f790d34ea"
        }
      ],
      "title": "net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80615",
    "datePublished": "2026-08-28T06:48:36.315Z",
    "dateReserved": "2026-08-26T14:34:25.774Z",
    "dateUpdated": "2026-08-29T06:21:24.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80615",
      "date": "2026-09-17",
      "epss": "0.00351",
      "percentile": "0.28682"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80615\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:45.523\",\"lastModified\":\"2026-08-29T07:16:46.377\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone\\n\\nkmalloc_flex() in metadata_dst_alloc() sets __counted_by for the\\nstructure to the options_len, which is then initialized to zero.\\nLater, we\u0027re initializing the structure by copying the tunnel info\\ntogether with the options, and this triggers a warning for a potential\\nmemcpy overflow, since the compiler estimates that the options can\u0027t\\nfit into the structure, even though the memory for them is actually\\nallocated.\\n\\n memcpy: detected buffer overflow: 104 byte write of buffer size 96\\n WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report\\n  skb_tunnel_info_unclone+0x179/0x190\\n  geneve_xmit+0x7fe/0xe00\\n\\nThe issue is triggered when built with clang and source fortification.\\n\\nFix that by doing the copy in two stages: first - the main data with\\nthe options_len, then the options.  This way the correct length should\\nbe known at the time of the copy.\\n\\nIt would be better if the options_len never changed after allocation,\\nbut the allocation code is a little separate from the initialization\\nand it would be awkward and potentially dangerous to return a struct\\nwith options_len set to a non-zero value from the metadata_dst_alloc().\\n\\nAnother option would be to use ip_tunnel_info_opts_set(), but it is\\ndoing too many unnecessary operations for the use case here.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/dst_metadata.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"69050f8d6d075dc01af7a5f2f550a8067510366f\",\"lessThan\":\"7ce31739fe88a558370135db95bbeec1e7ddfc29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"69050f8d6d075dc01af7a5f2f550a8067510366f\",\"lessThan\":\"4c6d43db2a4d2cef3921e885cf34798f790d34ea\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/dst_metadata.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c6d43db2a4d2cef3921e885cf34798f790d34ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7ce31739fe88a558370135db95bbeec1e7ddfc29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-02T17:47:46+00:00",
      "cve": "CVE-2026-80615",
      "id": "CVE-2026-80615",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "77",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80615.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:36:19Z",
      "cve": "CVE-2026-80615",
      "id": "CVE-2026-80615",
      "initial_release_date": "2026-08-28T16:36:19Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80615",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80615.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.