Linux Kernel EUVD-2026-28762

Requires local access with low-privilege authentication (PR:L) and CAP_NET_ADMIN capability to configure network interfaces. Exploitation specifically requires creating a bonding interface and enslaving a non-Ethernet device-specifically GRE tunnel (ip_gre, ip6_gre), and potentially other tunnel types like IPIP or SIT-to that bond using iproute2 commands (ip link set <tunnel> master <bond>). The vulnerability triggers when network traffic flows through the bonded interface, invoking header_ops callbacks. Default Linux installations do not automatically create bonding interfaces with enslaved tunnels, so the vulnerable configuration is non-default. Limiting factors include: requires local authenticated access (not remotely exploitable), requires network configuration privileges (CAP_NET_ADMIN), and requires the specific bonding+tunnel configuration which is uncommon outside advanced networking scenarios like VPN gateways, SDN deployments, or container networking with custom configurations. User interaction is not required once the vulnerable configuration exists.

This vulnerability presents moderate real-world risk despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low-privilege authentication is required, significantly limiting the attack surface compared to network-accessible vulnerabilities. The EPSS score of 0.02% (5th percentile) suggests extremely low probability of widespread exploitation in the wild, and no CISA KEV listing exists, confirming no active exploitation has been observed. However, the technical impact is severe: the type confusion reliably triggers kernel crashes (denial of service) and occurs in kernel memory management code paths where exploitation could potentially achieve privilege escalation or information disclosure. The attack complexity is genuinely low-the proof-of-concept commands in the description demonstrate that creating a bond with a GRE tunnel slave using standard iproute2 tools immediately triggers the crash. The vulnerability affects only specialized networking configurations where non-Ethernet devices are enslaved to bonds, which is uncommon in default deployments but may occur in advanced SDN, VPN gateway, or container networking environments. Patches are available across multiple stable kernel branches (6.12.78, 6.18.19, 6.19.9, 7.0), indicating vendor prioritization. Priority should be moderate for environments using bonding with tunnel interfaces, low for standard server deployments.

A local attacker with standard user privileges and CAP_NET_ADMIN capability (typically granted to network administrators or containers with elevated privileges) executes the following iproute2 commands: creates a GRE tunnel interface bound to a local IP address, creates a bonding interface in active-backup mode, enslaves the GRE tunnel to the bond, and brings both interfaces up. When IPv6 or packet socket traffic is sent through the bond interface, the kernel invokes dev_hard_header() which calls the GRE tunnel's ipgre_header() function with the bond device pointer. The ipgre_header() function uses netdev_priv() expecting struct ip_tunnel but receives struct bonding, reads garbage memory as tunnel parameters, and triggers a kernel BUG in pskb_expand_head() causing an immediate system crash. In environments where the attacker can control memory layout or trigger repeated exploitation, the type confusion may be leveraged for privilege escalation by manipulating the misinterpreted data structures.