CVE-2026-89562

Status: ReceivedHigh (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: fix hardware header length for NBMA tunnels

ip6gre_tnl_link_config_route() accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This is incorrect for both users of header_ops.

ip6gretap and ip6erspan have a fixed Ethernet hardware header length. For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header, the optional FOU or GUE header, and the outer IPv6 header. The lower device header is headroom needed later, not part of the tunnel device's hardware header.

Read full descriptionShow less

Keep the lower device header in needed_headroom. Set hard_header_len to the tunnel header length only for ARPHRD_IP6GRE devices with header_ops, and leave the fixed Ethernet header length unchanged for tap and erspan devices.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.13%
Percentile among all scored CVEs: 2
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Primary impactT1565.002 Transmitted Data Manipulationimpact70 %
Secondary impactT1499.004 Application or System Exploitationimpact65 %

Vulnerabilidad local con PR:L/UI:N que afecta configuración de headers en tunnels IPv6; permite manipulación de memoria o DoS por desbordamiento de buffer en el kernel.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Threat Intelligence Program Filter Network Traffic Execution Prevention Encrypt Sensitive Information Application Isolation and Sandboxing Exploit Protection

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux Kernel^AI

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-89562",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "cb1afd087aedc90e5274537e4fb9bf3f98e5afdb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "b1e95e3602d8e112458627f14c6c31c21f2188cb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "c3457a5aae5fb43f7023d3f3dc472c2afa22acf0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "8bfe746afee38dd6e4348ddcd22d554789dbb9ff",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "b8282668d8fa7c61b80e8e4890729031c291a16c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "565038b0092f65afe384961c0f548d605bf438b9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "832ba596494b2c9eac7760259eff2d8b7dcad0ee",
              "lessThan": "505b6d296c486ef7d1274f279d4c43a172f63224",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cf3d9717a5271573fa193c4dfa0df856295d5b15",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "187a6daf5db45adc807c85bbe285319107bed198",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d9897bb66ce989325b4bf4cdbb6a799e4ac878b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.19.162",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.4.82",
              "lessThan": "5.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.9.13",
              "lessThan": "5.10",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "net/ipv6/ip6_gre.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.10",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/ipv6/ip6_gre.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:40.063",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/505b6d296c486ef7d1274f279d4c43a172f63224",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/565038b0092f65afe384961c0f548d605bf438b9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7719f6e7ed2ffddc2c3bb61f4467b76d49e0af6a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8bfe746afee38dd6e4348ddcd22d554789dbb9ff",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1e95e3602d8e112458627f14c6c31c21f2188cb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b8282668d8fa7c61b80e8e4890729031c291a16c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c3457a5aae5fb43f7023d3f3dc472c2afa22acf0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cb1afd087aedc90e5274537e4fb9bf3f98e5afdb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_gre: fix hardware header length for NBMA tunnels\n\nip6gre_tnl_link_config_route() accumulates the lower device's hardware\nheader length into dev->hard_header_len whenever header_ops is set. This\nis incorrect for both users of header_ops.\n\nip6gretap and ip6erspan have a fixed Ethernet hardware header length.\nFor an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header,\nthe optional FOU or GUE header, and the outer IPv6 header. The lower\ndevice header is headroom needed later, not part of the tunnel device's\nhardware header.\n\nKeep the lower device header in needed_headroom. Set hard_header_len to\nthe tunnel header length only for ARPHRD_IP6GRE devices with header_ops,\nand leave the fixed Ethernet header length unchanged for tap and erspan\ndevices."
    }
  ],
  "lastModified": "2026-09-14T13:19:11.270",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}