CVE-2026-80612

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: lwtunnel: Drop skb metadata before LWT encapsulation

skb metadata is meant for passing information between XDP and TC. It lives

in the skb headroom, immediately before skb->data. LWT programs cannot

access the __sk_buff->data_meta pseudo-pointer to metadata.

However, LWT encapsulation prepends outer headers, moving skb->data back

over the headroom where the metadata sits. On an RX-originated (forwarded)

packet that still carries XDP metadata this goes wrong in two different

ways, depending on the encap type:

1. Non-BPF LWT encaps (mpls, seg6, ioam6 ...) call skb_push()/skb_pull()

and silently overwrite the metadata that sits in the headroom.

2) BPF LWT xmit calls bpf_skb_change_head(), which uses skb_data_move().

That helper expects metadata immediately before skb->data. But since

the IP output path runs LWT xmit before neighbour output has built

the outgoing L2 header, for forwarded packets skb->

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References