Description
In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: keep room for the mac header in dst_dev_overhead()

The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as
the length they are about to push plus dst_dev_overhead(), then push the
new headers and rebuild the mac header below them with
skb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom,
but dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device,
16 bytes for plain Ethernet.

Where the mac header is longer than that, as it is on ingress through a
VLAN device with reorder_hdr off, the rebuild runs out of room:
skb_set_mac_header(skb, -skb->mac_len) computes a negative offset,
stores it unchecked in the u16 skb->mac_header, and the memmove that
follows writes skb->mac_len bytes about 64 KB past skb->head.
Forwarding plain ping6 traffic through such a device reproduces it on
all five seg6 encapsulation modes and on the rpl and ioam6 inline paths;
skb->mac_header comes back as 65534 on a 704-byte head.

Return the larger of the two. The helper already returns skb->mac_len
when it has no dst, so this only makes the other branch agree, and it
covers every caller rather than each call site in turn.
Published: 2026-10-18
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel Memory Corruption
Action: Apply Patch
AI Analysis

Impact

An out‑of‑bounds write occurs in the Linux kernel when it processes IPv6 lightweight tunnels such as seg6, ioam6, or rpl that are used on a VLAN interface with reorder_hdr turned off. The code sizes its skb headroom based on dst_dev_overhead(), assuming 16 bytes of reserved space for a plain Ethernet MAC header. If the rebuilt MAC header is longer, skb_set_mac_header receives a negative offset, which is stored unchecked in skb->mac_header. The subsequent memmove copies skb->mac_len bytes beyond the skb head, corrupting memory past the start of the packet buffer. This corruption can crash the kernel or, if the attacker can control the contents, may allow arbitrary code execution.

Affected Systems

All Linux kernel installations that support seg6, ioam6, or rpl lightweight tunnels and forward IPv6 traffic through a VLAN device with reorder_hdr disabled are potentially affected. No specific release is mentioned; the vulnerability applies to any kernel containing the described code path until the commit referenced in the advisory is applied.

Risk and Exploitability

The flaw results in kernel memory corruption that can lead to a crash or local privilege escalation. The advisory reports a CVSS score of 5.9. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers need to be able to send crafted IPv6 packets to the affected host; remote exploitation is possible where such traffic is accepted. The issue is considered moderate severity due to its potential to compromise kernel integrity.

Generated by OpenCVE AI on October 20, 2026 at 16:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the fixed commits referenced in the advisory
  • Disable the seg6, ioam6, and rpl lightweight tunnel modules or block the related IPv6 traffic with firewall rules so the kernel never processes the vulnerable path
  • Reconfigure any VLAN interfaces to enable reorder_hdr or otherwise prevent packets with extended MAC headers from reaching the host

Generated by OpenCVE AI on October 20, 2026 at 16:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 19 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-787

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dst_dev_overhead() The seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as the length they are about to push plus dst_dev_overhead(), then push the new headers and rebuild the mac header below them with skb_mac_header_rebuild(). That rebuild needs skb->mac_len of headroom, but dst_dev_overhead() leaves LL_RESERVED_SPACE() of the egress device, 16 bytes for plain Ethernet. Where the mac header is longer than that, as it is on ingress through a VLAN device with reorder_hdr off, the rebuild runs out of room: skb_set_mac_header(skb, -skb->mac_len) computes a negative offset, stores it unchecked in the u16 skb->mac_header, and the memmove that follows writes skb->mac_len bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->mac_header comes back as 65534 on a 704-byte head. Return the larger of the two. The helper already returns skb->mac_len when it has no dst, so this only makes the other branch agree, and it covers every caller rather than each call site in turn.
Title net: ipv6: keep room for the mac header in dst_dev_overhead()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:21:55.765Z

Reserved: 2026-09-25T10:25:14.357Z

Link: CVE-2026-98570

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:09.233

Modified: 2026-10-19T10:19:15.053

Link: CVE-2026-98570

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98570 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T16:45:14Z

Weaknesses