CVE-2026-89563 - Vulnerability Details

- ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

ip6_tnl_xmit() may need to expand headroom before it can push the
outer IPv6 and optional encap headers. It currently does that with
skb_realloc_headroom(), copies skb->sk ownership, consumes the original
skb, and then continues processing with the replacement skb kept only in
its local variable.

That is safe only if the helper cannot fail afterwards. But this helper
still has post-reallocation error exits. collect_md tunnels reject
non-NONE encap after the replacement, and ip6_tnl_encap() can also fail
later. In those cases the helper returns an error to its callers while
the caller still only has the original skb pointer.

Both ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on
error, so they can end up freeing an skb that ip6_tnl_xmit() already
consumed.

Use skb_cow_head() instead. It provides the required headroom and
writability without privately replacing the caller-owned skb, so later
error returns cannot leave callers with a stale pointer.

The Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING
and already call skb_cow_head() before entering ip6_tnl_xmit(). They do
not rely on the removed skb_shared() reallocation. This also makes the
IPv6 tunnel path consistent with ip_tunnel_xmit().

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in the Linux kernel occurs when ip6_tnl_xmit() expands headroom for IPv6 tunnel headers using skb_realloc_headroom(). If that helper fails after expansion, subsequent error handling can free an original socket buffer that has already been consumed, leading to a stale pointer and potential double‑free or memory corruption. This flaw is a classic instance of improper error handling on kernel data structures (CWE‑1341) and can compromise system integrity by corrupting kernel memory. The developer mitigation replaces skb_realloc_headroom() with skb_cow_head(), making the headroom allocation safe even after failures, and aligns the tunnel path with other IP tunnel implementations.

Affected Systems

The issue affects the Linux kernel itself, as specified by the kernel vendor entries and the corresponding CPE string. All kernel versions prior to the patch that include the vulnerable ip6_tnl_xmit() implementation are impacted. Exact vulnerable version ranges are not listed, so any fix should be regarded as at risk.

Risk and Exploitability

The CVSS score of 4.4 classifies this as Low severity. EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likely attack vector is inferred to be delivery of malformed IPv6 tunnel packets from an external or internal attacker, which could trigger the faulty path during packet transmission. However, since the flaw requires specific failure conditions in the reallocation helper, it is considered non‑easily exploitable without further research.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`058214a4d1dfefed9f01a277fadd3590acb5f990`	affected	< 37df5bc6b5ccad88c2faa0f5466f150178882b74
`058214a4d1dfefed9f01a277fadd3590acb5f990`	affected	< b36dfd6e8cff00cea81c11cc0af88d1564763461
`058214a4d1dfefed9f01a277fadd3590acb5f990`	affected	< 8fc56ca49fc0ee1725b55c67bb43ab0dd01f3f52
`058214a4d1dfefed9f01a277fadd3590acb5f990`	affected	< 87f21b59ddc618eff9670c174842964ad65fdade

Linux

affected

Version	Status	Constraints
`4.7`	affected	—
`0`	unaffected	< 4.7
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[058214a4d1dfefed9f01a277fadd3590acb5f990,37df5bc6b5ccad88c2faa0f5466f150178882b74)`	affected	code_commit	—
`[058214a4d1dfefed9f01a277fadd3590acb5f990,b36dfd6e8cff00cea81c11cc0af88d1564763461)`	affected	code_commit	—
`[058214a4d1dfefed9f01a277fadd3590acb5f990,8fc56ca49fc0ee1725b55c67bb43ab0dd01f3f52)`	affected	code_commit	—
`[058214a4d1dfefed9f01a277fadd3590acb5f990,87f21b59ddc618eff9670c174842964ad65fdade)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.7`	affected	semver	—
`[0,4.7)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the skb_cow_head() change in ip6_tnl_xmit().
If an update is not yet available, apply the upstream patch that replaces skb_realloc_headroom() with skb_cow_head() in the ip6_tnl_xmit() function.
Verify kernel configuration for tunnel interfaces and ensure no custom modules override the standard IPv6 tunnel handling paths.

Generated by OpenCVE AI on September 13, 2026 at 04:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/37df5bc6b5ccad88c2faa0f5466f150178882b74
https://git.kernel.org/stable/c/87f21b59ddc618eff9670c174842964ad65fdade
https://git.kernel.org/stable/c/8fc56ca49fc0ee1725b55c67bb43ab0dd01f3f52
https://git.kernel.org/stable/c/b36dfd6e8cff00cea81c11cc0af88d1564763461
https://nvd.nist.gov/vuln/detail/CVE-2026-89563
https://www.cve.org/CVERecord?id=CVE-2026-89563

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1341
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89563 https://www.cve.org/CVERecord?id=CVE-2026-89563
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skb_realloc_headroom(), copies skb->sk ownership, consumes the original skb, and then continues processing with the replacement skb kept only in its local variable. That is safe only if the helper cannot fail afterwards. But this helper still has post-reallocation error exits. collect_md tunnels reject non-NONE encap after the replacement, and ip6_tnl_encap() can also fail later. In those cases the helper returns an error to its callers while the caller still only has the original skb pointer. Both ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on error, so they can end up freeing an skb that ip6_tnl_xmit() already consumed. Use skb_cow_head() instead. It provides the required headroom and writability without privately replacing the caller-owned skb, so later error returns cannot leave callers with a stale pointer. The Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING and already call skb_cow_head() before entering ip6_tnl_xmit(). They do not rely on the removed skb_shared() reallocation. This also makes the IPv6 tunnel path consistent with ip_tunnel_xmit().
Title		ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/37df5bc6b5ccad88c2faa0f5466f150178882b74 https://git.kernel.org/stable/c/87f21b59ddc618eff9670c174842964ad65fdade https://git.kernel.org/stable/c/8fc56ca49fc0ee1725b55c67bb43ab0dd01f3f52 https://git.kernel.org/stable/c/b36dfd6e8cff00cea81c11cc0af88d1564763461

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:44:34.375Z

Updated: 2026-09-13T06:31:03.944Z

Reserved: 2026-09-11T19:38:34.725Z

Link: CVE-2026-89563

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:40.193

Modified: 2026-09-13T07:17:22.580

Link: CVE-2026-89563

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:44:34Z

Links: CVE-2026-89563 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T05:00:12Z

Weaknesses

CWE-1341
Multiple Releases of Same Resource or Handle

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object