« Volver al listado

CVE-2026-89562

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: fix hardware header length for NBMA tunnels

ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops.

ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. The lower device header is headroom needed later, not part of the tunnel device's hardware header.

Leer descripción completaMostrar menos

Keep the lower device header in needed_headroom. Set hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, and leave the fixed Ethernet header length unchanged for tap and erspan devices.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad local con PR:L/UI:N que afecta configuración de headers en tunnels IPv6; permite manipulación de memoria o DoS por desbordamiento de buffer en el kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionEncrypt Sensitive InformationApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89562",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "cb1afd087aedc90e5274537e4fb9bf3f98e5afdb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "b1e95e3602d8e112458627f14c6c31c21f2188cb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "c3457a5aae5fb43f7023d3f3dc472c2afa22acf0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "8bfe746afee38dd6e4348ddcd22d554789dbb9ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "b8282668d8fa7c61b80e8e4890729031c291a16c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "565038b0092f65afe384961c0f548d605bf438b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "505b6d296c486ef7d1274f279d4c43a172f63224",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cf3d9717a5271573fa193c4dfa0df856295d5b15",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "187a6daf5db45adc807c85bbe285319107bed198",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9897bb66ce989325b4bf4cdbb6a799e4ac878b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.19.162",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.4.82",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.9.13",
              "lessThan": "5.10",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "net/ipv6/ip6_gre.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/ipv6/ip6_gre.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:40.063",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/505b6d296c486ef7d1274f279d4c43a172f63224",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/565038b0092f65afe384961c0f548d605bf438b9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8bfe746afee38dd6e4348ddcd22d554789dbb9ff",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1e95e3602d8e112458627f14c6c31c21f2188cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8282668d8fa7c61b80e8e4890729031c291a16c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c3457a5aae5fb43f7023d3f3dc472c2afa22acf0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cb1afd087aedc90e5274537e4fb9bf3f98e5afdb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_gre: fix hardware header length for NBMA tunnels\n\nip6gre_tnl_link_config_route() accumulates the lower device's hardware\nheader length into dev->hard_header_len whenever header_ops is set. This\nis incorrect for both users of header_ops.\n\nip6gretap and ip6erspan have a fixed Ethernet hardware header length.\nFor an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header,\nthe optional FOU or GUE header, and the outer IPv6 header. The lower\ndevice header is headroom needed later, not part of the tunnel device's\nhardware header.\n\nKeep the lower device header in needed_headroom. Set hard_header_len to\nthe tunnel header length only for ARPHRD_IP6GRE devices with header_ops,\nand leave the fixed Ethernet header length unchanged for tap and erspan\ndevices."
    }
  ],
  "lastModified": "2026-09-14T13:19:11.270",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}