Strix
63.1K

CVE-2026-80978

HIGHCVSS 7.8/10EPSS 0.13%

Last modified

CVE-2026-80978 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. EPSS estimates a 0.13% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.13%

2.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1a37e412a0225fcba5587f24c0dfc7636efc8b69, < fb889a619723032140f5d983a3a34d25a5a2bed4; >= 1a37e412a0225fcba5587f24c0dfc7636efc8b69, < b160422f8103574425e2834130e169d84c94fa1d; >= 1a37e412a0225fcba5587f24c0dfc7636efc8b69, < d36e75f5669140b66515ad3a176ca6337bd80a5e; >= 1a37e412a0225fcba5587f24c0dfc7636efc8b69, < 84783961cb8bdb36b4f41a02ce43aafc6d52b176; >= 1a37e412a0225fcba5587f24c0dfc7636efc8b69, < bc4e05ae66c9797a0972ac44326e69c5305e0020; >= 1a37e412a0225fcba5587f24c0dfc7636efc8b69, < af0ee8f04bea22cdb331fa3509e17f81b48938ad; >= 1a37e412a0225fcba5587f24c0dfc7636efc8b69, < 9144f2c53a04465a6878172b523f640313c5559e; >= 1a37e412a0225fcba5587f24c0dfc7636efc8b69, < 6b222adeb9340306e2ff97127c76117abb9b3df8
LinuxLinux3.11

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-80978?
In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.
How severe is CVE-2026-80978?
CVE-2026-80978 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.13% probability of exploitation in the next 30 days.
How do I fix CVE-2026-80978?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-80978?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST