CVE-2026-80612
Description
A flaw was found in the Linux kernel's lightweight tunnel (LWT) encapsulation process. This vulnerability occurs when network packets carrying specific metadata are processed, causing the system to incorrectly overwrite or clear this metadata. Such an issue can lead to unexpected behavior or data corruption during network traffic handling, potentially impacting the stability and integrity of network communications.
Statement
A MODERATE severity flaw was found in the Linux kernel's lightweight tunnel (lwtunnel) encapsulation handling. skb metadata, which is used to pass information between XDP and TC programs, lives in the skb headroom immediately before skb->data. When a forwarded (RX-originated) packet that still carries XDP metadata reaches an LWT encapsulation, the prepended outer headers move skb->data back over this headroom: non-BPF encapsulations (mpls, seg6, ioam6) silently overwrite the metadata via skb_push()/skb_pull(), while BPF LWT xmit triggers a kernel WARNING in skb_data_move() from softirq context and clears the metadata. The verified consequence is corruption or loss of XDP/TC metadata and a kernel WARNING in softirq context, which can affect the availability of network processing on systems configured with lightweight tunnels. Red Hat assessed this flaw as MODERATE with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs substantially from the upstream CVEORG CRITICAL rating of 9.8: reaching the flawed path requires a system already configured with LWT encapsulations processing forwarded traffic that carries XDP metadata, and the impact is limited to availability with no confidentiality or integrity impact. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected because the vulnerable code is not present in the shipped kernel versions of these products.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
