EUVD-2026-66573
GHSA-5qfp-9h7g-rcpm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires a non-default macvlan-over-headroom-device stack (AC:H) and local privilege to build/drive it (PR:L); impact is a kernel crash, so A:H with no confirmed C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0.
When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom.
Fix this by:
- Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init().
- Propagating needed_headroom and needed_tailroom updates to attached macvlans
in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
Articles & Coverage 1
AnalysisAI
Memory corruption in the Linux kernel's macvlan driver occurs because macvlan devices fail to inherit needed_headroom and needed_tailroom from their underlying lower device, leaving both at 0. On systems where a macvlan is stacked on a lower device requiring extra header/trailer space (macsec, IPsec, WireGuard, tunnels, or veth with RX headroom), the upper layers under-reserve skb space, producing headroom underflows and KASAN slab-use-after-free crashes during header insertion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific, non-default configuration: a macvlan device must be attached to a lower device that itself requires extra needed_headroom or needed_tailroom - explicitly macsec, IPsec, WireGuard, tunnel devices, or veth with RX headroom. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS is the Linux kernel's default-assigned CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8 Critical), but this materially overstates real-world risk and conflicts with the evidence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host where a container or VM uses a macvlan interface layered over a WireGuard, IPsec, macsec, or tunnel lower device, packet transmission causes the kernel to prepend headers into an skb without sufficient reserved headroom, underflowing the buffer and triggering a slab use-after-free that panics or destabilizes the kernel. A local user or an attacker able to drive traffic through that specific stacked interface could repeatedly trigger the crash for denial of service; no public exploit is currently identified. |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel - 6.1.184, 6.6.153, 6.12.105, 6.18.46, or 7.1.10 / 7.2 or later per your series - pulling the macvlan_init() headroom/tailroom inheritance fix (git.kernel.org commits 8cd90e850e43, cef51860becd, 96fa90b74385, bc9a00fb78e3, 28afc87bd8da, 8f6a05dbac05). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems in your environment running macvlan devices, particularly those in virtualization and container platforms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today