CVE-2026-80978

A flaw was found in the Linux kernel, specifically within its IP tunnel devices. A local attacker could create a stack of user-controlled IP tunnel devices, causing the system to miscalculate the required memory for network packet headers. This miscalculation can lead to unnecessary memory reallocations during packet transmission, which may result in performance degradation for network operations.

IP tunnel devices could advertise a needed_headroom value derived from lower devices without applying the runtime cap used on the transmit path. A stack of locally created tunnel devices can make this value exceed what 16-bit skb header offsets can represent, and later skb head expansion can wrap those offsets during skb_headers_offset_update(). For the CVSS the PR:L because reliable triggering requires a local process able to create or configure tunnel devices, often through CAP_NET_ADMIN or delegated network namespace rights. The issue is not directly network reachable by packet traffic alone. Packets may exercise the corrupted transmit path only after the local tunnel stack has been configured. Impact is at least denial of service via kernel crash, and in the paranoid case may include confidentiality or integrity impact because skb metadata offset wraparound is a memory corruption candidate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.