CVE-2026-80612: net: lwtunnel: Drop skb metadata before LWT encapsulation
In the Linux kernel, the following vulnerability has been resolved:
net: lwtunnel: Drop skb metadata before LWT encapsulation
skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb->data. LWT programs cannot access the skbuff->datameta pseudo-pointer to metadata.
However, LWT encapsulation prepends outer headers, moving skb->data back over the headroom where the metadata sits. On an RX-originated (forwarded) packet that still carries XDP metadata this goes wrong in two different ways, depending on the encap type:
1. Non-BPF LWT encaps (mpls, seg6, ioam6 ...) call skbpush()/skbpull() and silently overwrite the metadata that sits in the headroom.
2) BPF LWT xmit calls bpfskbchangehead(), which uses skbdatamove(). That helper expects metadata immediately before skb->data. But since the IP output path runs LWT xmit before neighbour output has built the outgoing L2 header, for forwarded packets skb->data points at the L3 header while skbmacheader() still points at the old L2 header. skbdatamove() sees metadata ending at skbmacheader(), not before skb->data, warns and clears metadata:
WARNING: CPU: 21 PID: 454557 at include/linux/skbuff.h:4609 skbdatamove+0x47/0x90 CPU: 21 UID: 0 PID: 454557 Comm: napi/iconduit-g Tainted: G O 6.18.21 #1 RIP: 0010:skbdatamove+0x47/0x90 Call Trace: <IRQ> bpfskbchangehead+0xe6/0x1a0 bpfprog...+0x213/0x2e3 runlwtbpf.isra.0+0x1d3/0x360 bpfxmit+0x46/0xe0 lwtunnelxmit+0xa1/0xf0 ipfinishoutput2+0x1e7/0x5e0 ipoutput+0x63/0x100 netifreceiveskbonecore+0x85/0xa0 processbacklog+0x9c/0x150 napipoll+0x2b/0x190 netrxaction+0x40b/0x7f0 handlesoftirqs+0xd2/0x270 dosoftirq+0x3f/0x60 </IRQ>
That is what happens, as for how to fix it - a received packet that carries metadata can reach an encap through any of the three LWT redirect modes:
LWTUNNELSTATEINPUTREDIRECT ip6rcvfinish dstinput lwtunnelinput
LWTUNNELSTATEOUTPUTREDIRECT ip6rcvfinish dstinput ip6forward ip6forwardfinish dstoutput lwtunneloutput
LWTUNNELSTATEXMITREDIRECT ip6rcvfinish dstinput ip6forward ip6forwardfinish dstoutput ip6output ip6finishoutput ip6finishoutput2 lwtunnelxmit
Every encap funnels through the three LWT dispatch helpers, so drop the metadata there, right before handing the skb to the encap op. This single chokepoint covers all encap types and all three redirect modes:
- lwtunnelinput(): seg6, rpl, ila, seg6local - lwtunneloutput(): ioam6 - lwtunnelxmit(): mpls, LWT BPF xmit
Alternatively, we could clear the metadata right after TC ingress hook. That would require a compromise, however. Metadata would become inaccessible from TC egress (in setups where it actually reaches the hook it tact, that is without any L2 tunnels on path).
Affected Software
Event History
Frequently Asked Questions
Which traffic path is affected?
The issue applies to RX-originated forwarded packets that still carry XDP metadata and then undergo LWT encapsulation. Locally originated traffic is not identified as affected in the provided information.
Does the impact differ by LWT encapsulation type?
Yes. Non-BPF LWT encapsulation, including MPLS, SEG6, and IOAM6, can silently overwrite metadata when it adjusts packet headroom. BPF LWT transmit can instead trigger a warning and clear the metadata during skb data movement.
How can I identify the BPF LWT variant of this issue?
The BPF LWT transmit path can produce a kernel warning when skb_data_move() finds metadata ending at the old MAC header rather than immediately before skb->data. Non-BPF encapsulation overwrites the metadata silently, so the described warning does not detect those cases.