GHSA-7HMJ-QV84-3GCJ
Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-29 09:30In the Linux kernel, the following vulnerability has been resolved:
net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't fit into the structure, even though the memory for them is actually allocated.
memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report skb_tunnel_info_unclone+0x179/0x190 geneve_xmit+0x7fe/0xe00
The issue is triggered when built with clang and source fortification.
Fix that by doing the copy in two stages: first - the main data with the options_len, then the options. This way the correct length should be known at the time of the copy.
It would be better if the options_len never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with options_len set to a non-zero value from the metadata_dst_alloc().
Another option would be to use ip_tunnel_info_opts_set(), but it is doing too many unnecessary operations for the use case here.
{
"affected": [],
"aliases": [
"CVE-2026-80615"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-28T08:16:45Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone\n\nkmalloc_flex() in metadata_dst_alloc() sets __counted_by for the\nstructure to the options_len, which is then initialized to zero.\nLater, we\u0027re initializing the structure by copying the tunnel info\ntogether with the options, and this triggers a warning for a potential\nmemcpy overflow, since the compiler estimates that the options can\u0027t\nfit into the structure, even though the memory for them is actually\nallocated.\n\n memcpy: detected buffer overflow: 104 byte write of buffer size 96\n WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report\n skb_tunnel_info_unclone+0x179/0x190\n geneve_xmit+0x7fe/0xe00\n\nThe issue is triggered when built with clang and source fortification.\n\nFix that by doing the copy in two stages: first - the main data with\nthe options_len, then the options. This way the correct length should\nbe known at the time of the copy.\n\nIt would be better if the options_len never changed after allocation,\nbut the allocation code is a little separate from the initialization\nand it would be awkward and potentially dangerous to return a struct\nwith options_len set to a non-zero value from the metadata_dst_alloc().\n\nAnother option would be to use ip_tunnel_info_opts_set(), but it is\ndoing too many unnecessary operations for the use case here.",
"id": "GHSA-7hmj-qv84-3gcj",
"modified": "2026-08-29T09:30:25Z",
"published": "2026-08-28T09:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80615"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c6d43db2a4d2cef3921e885cf34798f790d34ea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7ce31739fe88a558370135db95bbeec1e7ddfc29"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.