CVE-2026-80978 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers.

Is your site exposed to CVE-2026-80978?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0013

Probability of exploitation

0.03%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/6b222adeb9340306e2ff97127c76117abb9b3df8 https://git.kernel.org/stable/c/84783961cb8bdb36b4f41a02ce43aafc6d52b176 https://git.kernel.org/stable/c/9144f2c53a04465a6878172b523f640313c5559e https://git.kernel.org/stable/c/af0ee8f04bea22cdb331fa3509e17f81b48938ad https://git.kernel.org/stable/c/b160422f8103574425e2834130e169d84c94fa1d https://git.kernel.org/stable/c/bc4e05ae66c9797a0972ac44326e69c5305e0020 https://git.kernel.org/stable/c/d36e75f5669140b66515ad3a176ca6337bd80a5e https://git.kernel.org/stable/c/fb889a619723032140f5d983a3a34d25a5a2bed4

Frequently Asked Questions

What is CVE-2026-80978? +

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed_headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can represent. Once IP output reserves it, skb head expansion can wrap those offsets. The runtime transmit path already caps a growing needed_headroom at 512. Apply the same cap when tunnel configuration publishes needed_headroom derived from a lower output device. Capping the advertised value is safe: IP tunnel transmit still expands the skb when a packet needs more headroom. A nonsensical stacked configuration can therefore incur an extra reallocation, but it cannot publish an unbounded reservation to upper layers. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-80978? +

CVE-2026-80978 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0013, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-80978? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-80978