CVE-2026-89562

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ip6 gre module where the ip6gre tnl link config route() function incorrectly accumulates the lower device's hardware header length into the dev->hard header len variable whenever header ops is set. This affects both ip6gretap and ip6erspan, which should maintain a fixed Ethernet hardware header length. For Non-Broadcast Multi-Access (NBMA) tunnels, the ip6gre header() function generates the GRE header, the outer IPv6 header, and optional FOU or GUE headers, meaning the lower device header should be treated as needed headroom rather than part of the tunnel device's hardware header.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.