CVE-2026-98570: net: ipv6: keep room for the mac header in dst_dev_overhead()
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: keep room for the mac header in dstdevoverhead()
The seg6, ioam6 and rpl lwtunnels size their skbcowhead() request as the length they are about to push plus dstdevoverhead(), then push the new headers and rebuild the mac header below them with skbmacheaderrebuild(). That rebuild needs skb->maclen of headroom, but dstdevoverhead() leaves LLRESERVEDSPACE() of the egress device, 16 bytes for plain Ethernet.
Where the mac header is longer than that, as it is on ingress through a VLAN device with reorderhdr off, the rebuild runs out of room: skbsetmacheader(skb, -skb->maclen) computes a negative offset, stores it unchecked in the u16 skb->macheader, and the memmove that follows writes skb->maclen bytes about 64 KB past skb->head. Forwarding plain ping6 traffic through such a device reproduces it on all five seg6 encapsulation modes and on the rpl and ioam6 inline paths; skb->macheader comes back as 65534 on a 704-byte head.
Return the larger of the two. The helper already returns skb->maclen when it has no dst, so this only makes the other branch agree, and it covers every caller rather than each call site in turn.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which packet-processing paths are affected?
The issue affects all five SEG6 encapsulation modes, plus the RPL and IOAM6 inline paths. It occurs when these lwtunnel paths allocate headroom, add headers, and rebuild the MAC header.
What network configuration is needed to trigger the problem?
The MAC header must be longer than the egress device's reserved link-layer space. The described example is traffic entering through a VLAN device with reorder_hdr disabled, where the MAC header exceeds the 16 bytes reserved for plain Ethernet.
Does exploitation require unusual IPv6 traffic?
No special packet type is required in the described reproduction: forwarding ordinary ping6 traffic through the affected device configuration triggers the issue when one of the affected lwtunnel paths is used.
What evidence would indicate that the fault has been triggered?
A reported signature is skb->mac_header returning as 65534 on a 704-byte head. The invalid MAC-header offset causes the subsequent memmove to write skb->mac_len bytes roughly 64 KB beyond skb->head.