Strix
64.5K

CVE-2026-89562

HIGHCVSS 7.8/10EPSS 0.13%

Last modified

CVE-2026-89562 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops. ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. EPSS estimates a 0.13% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops. ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. The lower device header is headroom needed later, not part of the tunnel device's hardware header. Keep the lower device header in needed_headroom. Set hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, and leave the fixed Ethernet header length unchanged for tap and erspan devices.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.13%

2.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 832ba596494b2c9eac7760259eff2d8b7dcad0ee, < cb1afd087aedc90e5274537e4fb9bf3f98e5afdb; >= 832ba596494b2c9eac7760259eff2d8b7dcad0ee, < 7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a; >= 832ba596494b2c9eac7760259eff2d8b7dcad0ee, < b1e95e3602d8e112458627f14c6c31c21f2188cb; >= 832ba596494b2c9eac7760259eff2d8b7dcad0ee, < c3457a5aae5fb43f7023d3f3dc472c2afa22acf0; >= 832ba596494b2c9eac7760259eff2d8b7dcad0ee, < 8bfe746afee38dd6e4348ddcd22d554789dbb9ff; >= 832ba596494b2c9eac7760259eff2d8b7dcad0ee, < b8282668d8fa7c61b80e8e4890729031c291a16c; >= 832ba596494b2c9eac7760259eff2d8b7dcad0ee, < 565038b0092f65afe384961c0f548d605bf438b9; >= 832ba596494b2c9eac7760259eff2d8b7dcad0ee, < 505b6d296c486ef7d1274f279d4c43a172f63224; cf3d9717a5271573fa193c4dfa0df856295d5b15; 187a6daf5db45adc807c85bbe285319107bed198; d9897bb66ce989325b4bf4cdbb6a799e4ac878b6; >= 4.19.162, < 4.20; >= 5.4.82, < 5.5; >= 5.9.13, < 5.10
LinuxLinux5.10

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-89562?
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops. ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. The lower device header is headroom needed later, not part of the tunnel device's hardware header. Keep the lower device header in needed_headroom. Set hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, and leave the fixed Ethernet header length unchanged for tap and erspan devices.
How severe is CVE-2026-89562?
CVE-2026-89562 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.13% probability of exploitation in the next 30 days.
How do I fix CVE-2026-89562?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-89562?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST