CVE-2026-80612

A flaw was found in the Linux kernel's lightweight tunnel (LWT) encapsulation process. This vulnerability occurs when network packets carrying specific metadata are processed, causing the system to incorrectly overwrite or clear this metadata. Such an issue can lead to unexpected behavior or data corruption during network traffic handling, potentially impacting the stability and integrity of network communications.

A MODERATE severity flaw was found in the Linux kernel's lightweight tunnel (lwtunnel) encapsulation handling. skb metadata, which is used to pass information between XDP and TC programs, lives in the skb headroom immediately before skb->data. When a forwarded (RX-originated) packet that still carries XDP metadata reaches an LWT encapsulation, the prepended outer headers move skb->data back over this headroom: non-BPF encapsulations (mpls, seg6, ioam6) silently overwrite the metadata via skb_push()/skb_pull(), while BPF LWT xmit triggers a kernel WARNING in skb_data_move() from softirq context and clears the metadata. The verified consequence is corruption or loss of XDP/TC metadata and a kernel WARNING in softirq context, which can affect the availability of network processing on systems configured with lightweight tunnels. Red Hat assessed this flaw as MODERATE with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs substantially from the upstream CVEORG CRITICAL rating of 9.8: reaching the flawed path requires a system already configured with LWT encapsulations processing forwarded traffic that carries XDP metadata, and the impact is limited to availability with no confidentiality or integrity impact. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected because the vulnerable code is not present in the shipped kernel versions of these products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.