PT-2026-82912 · Linux · Linux
CVE-2026-80612
·
Published
2026-08-28
·
Updated
2026-08-28
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
net: lwtunnel: Drop skb metadata before LWT encapsulation
skb metadata is meant for passing information between XDP and TC. It lives
in the skb headroom, immediately before skb->data. LWT programs cannot
access the sk buff->data meta pseudo-pointer to metadata.
However, LWT encapsulation prepends outer headers, moving skb->data back
over the headroom where the metadata sits. On an RX-originated (forwarded)
packet that still carries XDP metadata this goes wrong in two different
ways, depending on the encap type:
- Non-BPF LWT encaps (mpls, seg6, ioam6 ...) call skb push()/skb pull() and silently overwrite the metadata that sits in the headroom.
- BPF LWT xmit calls bpf skb change head(), which uses skb data move(). That helper expects metadata immediately before skb->data. But since the IP output path runs LWT xmit before neighbour output has built the outgoing L2 header, for forwarded packets skb->data points at the L3 header while skb mac header() still points at the old L2 header. skb data move() sees metadata ending at skb mac header(), not before skb->data, warns and clears metadata:
WARNING: CPU: 21 PID: 454557 at include/linux/skbuff.h:4609 skb data move+0x47/0x90
CPU: 21 UID: 0 PID: 454557 Comm: napi/iconduit-g Tainted: G O 6.18.21 #1
RIP: 0010:skb data move+0x47/0x90
Call Trace:
bpf skb change head+0xe6/0x1a0
bpf prog ...+0x213/0x2e3
run lwt bpf.isra.0+0x1d3/0x360
bpf xmit+0x46/0xe0
lwtunnel xmit+0xa1/0xf0
ip finish output2+0x1e7/0x5e0
ip output+0x63/0x100
netif receive skb one core+0x85/0xa0
process backlog+0x9c/0x150
napi poll+0x2b/0x190
net rx action+0x40b/0x7f0
handle softirqs+0xd2/0x270
do softirq+0x3f/0x60
That is what happens, as for how to fix it - a received packet that
carries metadata can reach an encap through any of the three LWT
redirect modes:
LWTUNNEL STATE INPUT REDIRECT
ip6 rcv finish
dst input
lwtunnel input
LWTUNNEL STATE OUTPUT REDIRECT
ip6 rcv finish
dst input
ip6 forward
ip6 forward finish
dst output
lwtunnel output
LWTUNNEL STATE XMIT REDIRECT
ip6 rcv finish
dst input
ip6 forward
ip6 forward finish
dst output
ip6 output
ip6 finish output
ip6 finish output2
lwtunnel xmit
Every encap funnels through the three LWT dispatch helpers, so drop the
metadata there, right before handing the skb to the encap op. This
single chokepoint covers all encap types and all three redirect modes:
- lwtunnel input(): seg6, rpl, ila, seg6 local
- lwtunnel output(): ioam6
- lwtunnel xmit(): mpls, LWT BPF xmit
Alternatively, we could clear the metadata right after TC ingress hook.
That would require a compromise, however. Metadata would become
inaccessible from TC egress (in setups where it actually reaches the
hook it tact, that is without any L2 tunnels on path).
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux