CVE-2026-80615

A flaw was found in the Linux kernel's dst_metadata component. When copying tunnel information and options within the tun_dst_unclone function, a compiler warning for a potential memory buffer overflow is triggered. This warning is a false positive, as memory is correctly allocated, but it can lead to misleading diagnostics.

A moderate-impact flaw was found in the Linux kernel's dst_metadata tunnel metadata handling, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9.9, 9.10, 10.3, and 10.4, and the kernel packages in Red Hat In-Vehicle OS 2.0 and 2.1. When a kernel is built with clang and source fortification enabled, tun_dst_unclone() initializes tunnel metadata by copying the tunnel information together with its options in a single memcpy. Because the flexible-array member's __counted_by length (options_len) is still zero at that point, the fortified memcpy logic reports a potential buffer overflow, even though the memory for the options was correctly allocated; the reported overflow is a false positive and no out-of-bounds write actually occurs. The practical consequence is a misleading kernel fortify WARNING and diagnostics (for example when transmitting through a geneve tunnel) rather than memory corruption, which Red Hat's moderate rating (CVSS 5.5, local vector, availability-only impact) reflects. The CVE.org score of 8.2 with a network attack vector overstates the risk because the underlying condition is a compiler-side false positive rather than a remotely exploitable overflow. Fixes for the affected streams are currently deferred because the issue does not cause actual memory corruption, and the residual risk of deferral is limited to spurious fortify warnings in the kernel log when tunnel options are cloned on affected build configurations. RHEL 7, RHEL 8, the RHEL 9.2 through 9.8 z-streams, RHEL 10.0.z and 10.2.z, and the OpenShift Container Platform RHCOS streams are marked not affected because the vulnerable code is not present, and RHEL 6 ELS is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.