CVE-2026-89562 - Vulnerability Details

- ip6_gre: fix hardware header length for NBMA tunnels

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: fix hardware header length for NBMA tunnels

ip6gre_tnl_link_config_route() accumulates the lower device's hardware
header length into dev->hard_header_len whenever header_ops is set. This
is incorrect for both users of header_ops.

ip6gretap and ip6erspan have a fixed Ethernet hardware header length.
For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header,
the optional FOU or GUE header, and the outer IPv6 header. The lower
device header is headroom needed later, not part of the tunnel device's
hardware header.

Keep the lower device header in needed_headroom. Set hard_header_len to
the tunnel header length only for ARPHRD_IP6GRE devices with header_ops,
and leave the fixed Ethernet header length unchanged for tap and erspan
devices.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel bug causes the hard_header_len of NBMA GRE tunnels to incorrectly include the lower device’s hardware header length when header_ops is enabled. This miscalculation can lead to inaccurate header length values for ARPHRD_IP6GRE devices that use header_ops, while tap and erspan devices retain their fixed Ethernet header header calculation.

Affected Systems

Linux kernel versions that do not505b6d296c486ef7d1274f279d4c43a172f63224) are affected. Distributions shipping kernel releases prior to that commit, as well as custom kernel builds that enable header_ops for ARPHRD_IP6GRE devices without the patch, remain vulnerable.

Risk and Exploitability

The CVSS score is 7.8, indicating high severity, while the EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low exploitation probability. The likely attack vector is traffic to a vulnerable interface, which could trigger the incorrect header calculation. No further exploitation method is documented beyond the incorrect header length handling.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`832ba596494b2c9eac7760259eff2d8b7dcad0ee`	affected	< cb1afd087aedc90e5274537e4fb9bf3f98e5afdb
`832ba596494b2c9eac7760259eff2d8b7dcad0ee`	affected	< 7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a
`832ba596494b2c9eac7760259eff2d8b7dcad0ee`	affected	< b1e95e3602d8e112458627f14c6c31c21f2188cb
`832ba596494b2c9eac7760259eff2d8b7dcad0ee`	affected	< c3457a5aae5fb43f7023d3f3dc472c2afa22acf0
`832ba596494b2c9eac7760259eff2d8b7dcad0ee`	affected	< 8bfe746afee38dd6e4348ddcd22d554789dbb9ff
`832ba596494b2c9eac7760259eff2d8b7dcad0ee`	affected	< b8282668d8fa7c61b80e8e4890729031c291a16c
`832ba596494b2c9eac7760259eff2d8b7dcad0ee`	affected	< 565038b0092f65afe384961c0f548d605bf438b9
`832ba596494b2c9eac7760259eff2d8b7dcad0ee`	affected	< 505b6d296c486ef7d1274f279d4c43a172f63224
`cf3d9717a5271573fa193c4dfa0df856295d5b15`	affected	—
`187a6daf5db45adc807c85bbe285319107bed198`	affected	—
`d9897bb66ce989325b4bf4cdbb6a799e4ac878b6`	affected	—
`4.19.162`	affected	< 4.20
`5.4.82`	affected	< 5.5
`5.9.13`	affected	< 5.10

Linux

affected

Version	Status	Constraints
`5.10`	affected	—
`0`	unaffected	< 5.10
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[832ba596494b2c9eac7760259eff2d8b7dcad0ee,8bfe746afee38dd6e4348ddcd22d554789dbb9ff)`	affected	code_commit	—
`[832ba596494b2c9eac7760259eff2d8b7dcad0ee,b8282668d8fa7c61b80e8e4890729031c291a16c)`	affected	code_commit	—
`[832ba596494b2c9eac7760259eff2d8b7dcad0ee,565038b0092f65afe384961c0f548d605bf438b9)`	affected	code_commit	—
`[832ba596494b2c9eac7760259eff2d8b7dcad0ee,505b6d296c486ef7d1274f279d4c43a172f63224)`	affected	code_commit	—
`cf3d9717a5271573fa193c4dfa0df856295d5b15`	affected	code_commit	—
`187a6daf5db45adc807c85bbe285319107bed198`	affected	code_commit	—
`d9897bb66ce989325b4bf4cdbb6a799e4ac878b6`	affected	code_commit	—
`[4.19.162,4.20)`	affected	semver	—
`[5.4.82,5.5)`	affected	semver	—
`[5.9.13,5.10)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.10`	affected	semver	—
`[0,5.10)`	unaffected	semver	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that contains the hard_header_len fix for NBMA IP6GRE tunnels.
If an update cannot be applied immediately, restrict GRE traffic on interfaces that use affected NBMA tunnels by configuring firewall rules or disabling the tunnels.
Continue monitoring kernel logs and network traffic for GRE packet anomalies, and adjust firewall policies to mitigate potential misrouting until the patch is fully deployed.

Generated by OpenCVE AI on September 15, 2026 at 21:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/505b6d296c486ef7d1274f279d4c43a172f63224
https://git.kernel.org/stable/c/565038b0092f65afe384961c0f548d605bf438b9
https://git.kernel.org/stable/c/7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a
https://git.kernel.org/stable/c/8bfe746afee38dd6e4348ddcd22d554789dbb9ff
https://git.kernel.org/stable/c/b1e95e3602d8e112458627f14c6c31c21f2188cb
https://git.kernel.org/stable/c/b8282668d8fa7c61b80e8e4890729031c291a16c
https://git.kernel.org/stable/c/c3457a5aae5fb43f7023d3f3dc472c2afa22acf0
https://git.kernel.org/stable/c/cb1afd087aedc90e5274537e4fb9bf3f98e5afdb

History

Tue, 15 Sep 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Mon, 14 Sep 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-129

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a https://git.kernel.org/stable/c/b1e95e3602d8e112458627f14c6c31c21f2188cb https://git.kernel.org/stable/c/c3457a5aae5fb43f7023d3f3dc472c2afa22acf0 https://git.kernel.org/stable/c/cb1afd087aedc90e5274537e4fb9bf3f98e5afdb

Mon, 14 Sep 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-129

Sun, 13 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-129

Sun, 13 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-129

Sun, 13 Sep 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-124 CWE-129

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-124 CWE-129

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops. ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. The lower device header is headroom needed later, not part of the tunnel device's hardware header. Keep the lower device header in needed_headroom. Set hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, and leave the fixed Ethernet header length unchanged for tap and erspan devices.
Title		ip6_gre: fix hardware header length for NBMA tunnels
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/505b6d296c486ef7d1274f279d4c43a172f63224 https://git.kernel.org/stable/c/565038b0092f65afe384961c0f548d605bf438b9 https://git.kernel.org/stable/c/8bfe746afee38dd6e4348ddcd22d554789dbb9ff https://git.kernel.org/stable/c/b8282668d8fa7c61b80e8e4890729031c291a16c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:33.576Z

Updated: 2026-09-14T12:01:02.225Z

Reserved: 2026-09-11T19:38:34.725Z

Link: CVE-2026-89562

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:40.063

Modified: 2026-09-14T13:19:11.270

Link: CVE-2026-89562

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-15T22:00:17Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object