Linux Kernel EUVD-2026-67491

Exploitation requires all of the following non-default conditions: (1) the Linux kernel must be compiled with the clang compiler (not GCC, which is the default for most distributions) with FORTIFY_SOURCE/source fortification enabled; (2) the GENEVE kernel module must be loaded and an active GENEVE tunnel interface must be configured on the target host; (3) the kernel's fortification warning must be configured to escalate to a fatal condition (BUG/panic) for availability impact to materialize. Systems running standard distribution kernels built with GCC are not affected. The C:L confidentiality impact in the provided CVSS vector is not substantiated by the description and should be treated as unconfirmed. Authentication requirements are not confirmed from available data for the GENEVE packet trigger, though network adjacency is implied.

The NVD-assigned CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) materially overstates real-world risk. The description explicitly characterizes this as a false-positive triggered only when building the kernel with clang and FORTIFY_SOURCE-conditions absent from the vast majority of production Linux deployments, which use GCC. Additionally, GENEVE tunneling must be configured and active, further narrowing the attack surface. AC:L is inconsistent with these non-default prerequisites; AC:H is more appropriate. The C:L impact is unexplained by the description and appears speculative. EPSS of 0.17% at the 7th percentile strongly corroborates negligible exploitation interest. The vulnerability is not in CISA KEV and no public exploit exists. Real risk is bounded to clang-built, fortification-hardened Linux kernels with GENEVE tunnels active-a rare combination in production. The actual severity is closer to a Medium than a High.

An attacker on a network segment adjacent to a Linux host running GENEVE tunnels sends crafted encapsulated packets that trigger the geneve_xmit transmit path. The kernel processes the packet through skb_tunnel_info_unclone, invoking tun_dst_unclone, where the single-stage memcpy of tunnel info and options fires the FORTIFY_SOURCE overflow check. On a clang-built kernel where this warning escalates to a BUG() or panic, the host becomes unavailable. No public proof-of-concept exploit exists.