CVE-2024-26882
kernel: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 17, 2024
Updated · August 5, 2026
Description
A flaw was found in the ip_tunnel implementation in the Linux kernel. This flaw occurs because the ip_tunnel_rcv() function does not properly pull the inner IP header before processing. A remote attacker could exploit this by sending crafted tunneled packets, potentially leading to a denial of service or incorrect packet handling. This impacts the integrity and availability of systems using IP tunneling.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-158 · Improper Neutralization of Null Byte or NUL Character