The Linux kernel’s ip6gre_tnl_link_config_route routine incorrectly adds the lower device’s hardware header length to the tunnel’s hard_header_len when header_ops is enabled. For NBMA GRE tunnels, ip6gre_header constructs only the GRE header, optional FOU/GUE header, and the outer IPv6 header; the lower device header should remain as needed headroom, not part of the tunnel’s hardware header. The incorrect accumulation could cause the kernel to miscalculate buffer sizes for the tunnel, potentially leading to kernel instability.

Linux kernel versions released before commit 505b6d296c486ef7d1274f279d4c43a172f63224 that include the ip6gretap or ip6erspan NBMA GRE tunnel code are affected. Distributions shipping newer kernel releases with the fix or custom builds that enable header_ops for ARPHRD_IP6GRE devices are not affected.

The vulnerability has a CVSS score of 7.8, indicating high severity. The EPSS score is less than 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of widespread exploitation. The likely attack vector involves an external actor sending malformed GRE packets to a vulnerable interface that is configured for NBMA GRE tunnels; exploitation would require the traffic to reach the host, so systems with restrictive routing or firewall policies may mitigate the risk.