Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80978— net: cap advertised IP tunnel headroom

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于IP隧道设备从下层输出设备派生通告的needed_headroom时未进行上限限制，用户创建的设备堆叠可使该值超出16位skb标头偏移可表示的范围，导致skb头部偏移回绕。

CVSS 7.8 · High EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1595 · Active Scanning

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1a37e412a0225fcba5587f24c0dfc7636efc8b69< fb889a619723032140f5d983a3a34d25a5a2bed4 affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69< b160422f8103574425e2834130e169d84c94fa1d affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69< d36e75f5669140b66515ad3a176ca6337bd80a5e affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69< 84783961cb8bdb36b4f41a02ce43aafc6d52b176 affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69< bc4e05ae66c9797a0972ac44326e69c5305e0020 affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69< af0ee8f04bea22cdb331fa3509e17f81b48938ad affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69< 9144f2c53a04465a6878172b523f640313c5559e affected
1a37e412a0225fcba5587f24c0dfc7636efc8b69< 6b222adeb9340306e2ff97127c76117abb9b3df8 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80978

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: cap advertised IP tunnel headroom
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于IP隧道设备从下层输出设备派生通告的needed_headroom时未进行上限限制，用户创建的设备堆叠可使该值超出16位skb标头偏移可表示的范围，导致skb头部偏移回绕。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1a37e412a0225fcba5587f24c0dfc7636efc8b69 ~ fb889a619723032140f5d983a3a34d25a5a2bed4 -
Linux Linux 3.11 -

II. Public POCs for CVE-2026-80978

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80978

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80978 (8)

Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total

CVE-2026-89688 9.8 CRITICAL nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
CVE-2026-89656 9.8 CRITICAL libceph: reject buckets with mismatched CRUSH ids
CVE-2026-89655 9.8 CRITICAL ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
CVE-2026-89658 9.8 CRITICAL NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
CVE-2026-89660 9.8 CRITICAL NFSD: Prevent client use-after-free during admin state revocation
CVE-2026-89659 9.8 CRITICAL NFSD: Prevent client use-after-free during delegation revoke
CVE-2026-89662 9.8 CRITICAL NFSD: Prevent lock owner use-after-free during client teardown
CVE-2026-89669 9.8 CRITICAL nfsd: initialize copy-notify stateid before publishing it
CVE-2026-89674 9.8 CRITICAL nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
CVE-2026-89675 9.8 CRITICAL nfsd: fix UAF in async copy cancel and shutdown
CVE-2026-89676 9.8 CRITICAL nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
CVE-2026-89677 9.8 CRITICAL nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
CVE-2026-89681 9.8 CRITICAL nfsd: fix layout fence worker double-reference race
CVE-2026-89686 9.8 CRITICAL nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
CVE-2026-89478 9.8 CRITICAL sctp: drop a chunk if its transport was removed
CVE-2026-89479 9.8 CRITICAL sctp: stop processing a packet once its association is deleted
CVE-2026-89702 9.8 CRITICAL nfsd: size fh_verify server sockaddr slot by xpt_locallen
CVE-2026-89703 9.8 CRITICAL nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
CVE-2026-89482 9.8 CRITICAL nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89708 9.8 CRITICAL nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

Showing top 20 of 431 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80978

No comments yet

Leave a comment