← Back to CVE Explorer

CVE-2026-89562

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: fix hardware header length for NBMA tunnels ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops. ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. The lower device header is headroom needed later, not part of the tunnel device's hardware header. Keep the lower device header in needed_headroom. Set hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, and leave the fixed Ethernet header length unchanged for tap and erspan devices.

Severity
HIGH
CVSS score
7.8 (v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-11 20:19:40.063000
Last modified
2026-10-19 09:17:51.897000
View original CVE JSON 
{
  "id": "CVE-2026-89562",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-11T20:19:40.063",
  "lastModified": "2026-10-19T09:17:51.897",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_gre: fix hardware header length for NBMA tunnels\n\nip6gre_tnl_link_config_route() accumulates the lower device's hardware\nheader length into dev->hard_header_len whenever header_ops is set. This\nis incorrect for both users of header_ops.\n\nip6gretap and ip6erspan have a fixed Ethernet hardware header length.\nFor an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header,\nthe optional FOU or GUE header, and the outer IPv6 header. The lower\ndevice header is headroom needed later, not part of the tunnel device's\nhardware header.\n\nKeep the lower device header in needed_headroom. Set hard_header_len to\nthe tunnel header length only for ARPHRD_IP6GRE devices with header_ops,\nand leave the fixed Ethernet header length unchanged for tap and erspan\ndevices."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "net/ipv6/ip6_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "cb1afd087aedc90e5274537e4fb9bf3f98e5afdb",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "b1e95e3602d8e112458627f14c6c31c21f2188cb",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "c3457a5aae5fb43f7023d3f3dc472c2afa22acf0",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "8bfe746afee38dd6e4348ddcd22d554789dbb9ff",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "b8282668d8fa7c61b80e8e4890729031c291a16c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "565038b0092f65afe384961c0f548d605bf438b9",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "505b6d296c486ef7d1274f279d4c43a172f63224",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "cf3d9717a5271573fa193c4dfa0df856295d5b15",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "187a6daf5db45adc807c85bbe285319107bed198",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "d9897bb66ce989325b4bf4cdbb6a799e4ac878b6",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4.19.162",
              "lessThan": "4.20",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.4.82",
              "lessThan": "5.5",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.9.13",
              "lessThan": "5.10",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "net/ipv6/ip6_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.10",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.10",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.270",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.221",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.188",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.157",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.109",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.50",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.4",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/505b6d296c486ef7d1274f279d4c43a172f63224",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/565038b0092f65afe384961c0f548d605bf438b9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8bfe746afee38dd6e4348ddcd22d554789dbb9ff",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1e95e3602d8e112458627f14c6c31c21f2188cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8282668d8fa7c61b80e8e4890729031c291a16c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c3457a5aae5fb43f7023d3f3dc472c2afa22acf0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cb1afd087aedc90e5274537e4fb9bf3f98e5afdb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}