CVE-2026-80615: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
In the Linux kernel, the following vulnerability has been resolved:
net: dstmetadata: fix false-positive memcpy overflow in tundstunclone
kmallocflex() in metadatadstalloc() sets countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't fit into the structure, even though the memory for them is actually allocated.
memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X PID: Y at lib/stringhelpers.c:1036 fortifyreport skbtunnelinfounclone+0x179/0x190 genevexmit+0x7fe/0xe00
The issue is triggered when built with clang and source fortification.
Fix that by doing the copy in two stages: first - the main data with the optionslen, then the options. This way the correct length should be known at the time of the copy.
It would be better if the optionslen never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with optionslen set to a non-zero value from the metadatadstalloc().
Another option would be to use iptunnelinfooptsset(), but it is doing too many unnecessary operations for the use case here.
Affected Software
Event History
Frequently Asked Questions
Which environments are affected by the reported overflow warning?
The issue is triggered in Linux kernel builds that use Clang with source fortification enabled. The reported call trace includes skb_tunnel_info_unclone during geneve_xmit, involving tunnel metadata with options.
Does the report indicate that allocated memory is actually too small for the copied options?
No. The report describes this as a false-positive memcpy overflow: metadata_dst_alloc() allocates space for the options, but the compiler cannot determine that the options fit because options_len is initially zero when the structure is allocated.
How can I tell whether this issue is occurring on a system?
Look for a fortify warning reporting a memcpy buffer overflow, such as a 104-byte write to a 96-byte buffer, with __fortify_report, skb_tunnel_info_unclone, and geneve_xmit in the stack trace. The warning is expected under the affected Clang source-fortified build conditions.