EUVD-2026-76301
GHSA-p2qp-rm9g-w8f3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed; PR:L because unprivileged user namespaces allow tunnel creation without root on default distributions.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: cap advertised IP tunnel headroom
IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets.
The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device.
Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.
AnalysisAI
Integer overflow in the Linux kernel IP tunnel subsystem allows a local low-privilege attacker to stack user-created tunnel devices until the cumulative advertised needed_headroom exceeds the 16-bit skb header offset capacity. When IP output subsequently reserves that headroom, the offset arithmetic wraps around, producing a kernel memory corruption condition with potential for local privilege escalation to root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires creating a sufficient stack of IP tunnel devices to overflow the 16-bit `needed_headroom` counter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is well-matched to the described attack: local shell access with low privilege is sufficient to create stacked tunnel devices, and the impact is full kernel memory compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Linux kernel to a patched release: 6.12.109 or later for systems tracking the 6.12 LTS branch, 6.18.50 or later for the 6.18 stable branch, or 7.2.4 or later for the 7.2 branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems to determine kernel versions and identify which systems have IP tunnel functionality enabled; prioritize systems allowing local user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today