CVE-2026-80612

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the lwtunnel component where skb metadata, used for passing information between XDP (eXpress Data Path) and TC (Traffic Control), is not properly handled before LWT (Lightweight Tunnel) encapsulation. LWT encapsulation prepends outer headers, which moves skb->data back over the headroom where metadata is stored. For forwarded packets that still carry XDP metadata, this leads to two scenarios: non-BPF LWT encaps (such as mpls, seg6, and ioam6) may silently overwrite the metadata using skb push() or skb pull(), while BPF LWT xmit calls bpf skb change head(), which utilizes skb data move(). Because the IP output path runs LWT xmit before the outgoing L2 header is built, skb data move() incorrectly identifies the metadata boundaries, resulting in a system warning and the clearing of metadata. The issue affects the following dispatch helpers: lwtunnel input(), lwtunnel output(), and lwtunnel xmit().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.