UBUNTU-CVE-2026-80612: Critical severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb->data. LWT programs cannot access the skbuff->datameta pseudo-pointer to metadata. However, LWT encapsulation prepends outer headers, moving skb->data back over the headroom where the metadata sits. On an RX-originated (forwarded) packet that still carries XDP metadata this goes wrong in two different ways, depending on the encap type: 1. Non-BPF LWT encaps (mpls, seg6, ioam6 ...) call skbpush()/skbpull() and silently overwrite the metadata that sits in the headroom. 2) BPF LWT xmit calls bpfskbchangehead(), which uses skbdatamove(). That helper expects metadata immediately before skb->data. But since the IP output path runs LWT xmit before neighbour output has built the outgoing L2 header, for forwarded packets skb->data points at the L3 header while skbmacheader() still points at the old L2 header. skbdatamove() sees metadata ending at skbmacheader(), not before skb->data, warns and clears metadata: WARNING: CPU: 21 PID: 454557 at include/linux/skbuff.h:4609 skbdatamove+0x47/0x90 CPU: 21 UID: 0 PID: 454557 Comm: napi/iconduit-g Tainted: G O 6.18.21 #1 RIP: 0010:skbdatamove+0x47/0x90 Call Trace: <IRQ> bpfskbchangehead+0xe6/0x1a0 bpfprog...+0x213/0x2e3 runlwtbpf.isra.0+0x1d3/0x360 bpfxmit+0x46/0xe0 lwtunnelxmit+0xa1/0xf0 ipfinishoutput2+0x1e7/0x5e0 ipoutput+0x63/0x100 netifreceiveskbonecore+0x85/0xa0 processbacklog+0x9c/0x150 napipoll+0x2b/0x190 netrxaction+0x40b/0x7f0 handlesoftirqs+0xd2/0x270 dosoftirq+0x3f/0x60 </IRQ> That is what happens, as for how to fix it - a received packet that carries metadata can reach an encap through any of the three LWT redirect modes: LWTUNNELSTATEINPUTREDIRECT ip6rcvfinish dstinput lwtunnelinput LWTUNNELSTATEOUTPUTREDIRECT ip6rcvfinish dstinput ip6forward ip6forwardfinish dstoutput lwtunneloutput LWTUNNELSTATEXMITREDIRECT ip6rcvfinish dstinput ip6forward ip6forwardfinish dstoutput ip6output ip6finishoutput ip6finishoutput2 lwtunnelxmit Every encap funnels through the three LWT dispatch helpers, so drop the metadata there, right before handing the skb to the encap op. This single chokepoint covers all encap types and all three redirect modes: - lwtunnelinput(): seg6, rpl, ila, seg6local - lwtunneloutput(): ioam6 - lwtunnelxmit(): mpls, LWT BPF xmit Alternatively, we could clear the metadata right after TC ingress hook. That would require a compromise, however. Metadata would become inaccessible from TC egress (in setups where it actually reaches the hook it tact, that is without any L2 tunnels on path).