EUVD-2026-76473
GHSA-672h-29w5-4fj2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges required to configure or interact with ip6gre tunnels; no user interaction; full kernel impact if heap corruption is successfully weaponized.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ip6_gre: fix hardware header length for NBMA tunnels
ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops.
ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. The lower device header is headroom needed later, not part of the tunnel device's hardware header.
Keep the lower device header in needed_headroom. Set hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, and leave the fixed Ethernet header length unchanged for tap and erspan devices.
AnalysisAI
Incorrect hardware header length computation in the Linux kernel's ip6_gre driver creates a memory layout miscalculation in NBMA IPv6 GRE tunnel configurations, exploitable locally by a low-privileged user to corrupt kernel memory and potentially achieve privilege escalation. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len when header_ops is set, affecting both NBMA ip6gre tunnels and ip6gretap/ip6erspan devices across a wide range of kernel versions from 4.19 onward. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local access to the target system with at least low-privilege credentials (PR:L per CVSS); (2) the ip6_gre kernel module must be loaded - this occurs automatically when any IPv6 GRE, ip6gretap, or ip6erspan tunnel is configured; (3) the tunnel's lower (underlay) device must have hardware header operations (header_ops) set, which applies to standard Ethernet-backed interfaces; (4) the attacker must be able to trigger ip6gre_tnl_link_config_route(), which fires during tunnel link configuration events. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is broadly consistent with a local kernel memory corruption bug exploitable by a low-privileged user, with the C:H/I:H/A:H triad suggesting potential for full kernel compromise rather than mere denial of service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released kernel patches by upgrading to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, which contain the corrected ip6gre_tnl_link_config_route() logic. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify which systems in your infrastructure use ip6_gre, ip6gretap, or ip6erspan tunnel configurations by reviewing network configurations and kernel module loading. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today