Description

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached macvlans in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T15:16:53.113Z",
  "pubdate": "2026-08-26T15:16:53.113Z",
  "executiveSummary": "The Linux kernel's macvlan driver fails to properly inherit needed_headroom and needed_tailroom properties from underlying physical devices. This omission results in a critical configuration discrepancy where upper-layer networking protocols remain unaware of the additional buffer space requirements mandated by the lower-layer interfaces, such as tunnels, macsec, or veth devices.\nThis vulnerability is categorized as an improper memory management flaw, potentially leading to kernel-level memory corruption. When a macvlan interface is used over an underlying device requiring significant headroom or tailroom, the packet metadata calculations performed by the network stack can be inaccurate. This inconsistency leads to skb (socket buffer) headroom underflows during header/trailer prepending or appending operations.\nThe impact includes performance degradation due to forced reallocations and, more critically, system instability manifested as KASAN slab-use-after-free crashes or heap buffer overflows. An attacker capable of triggering network traffic through a macvlan interface configured on an underlying device with specific headroom requirements could potentially induce these kernel crashes, resulting in a Denial of Service (DoS) or, in specific scenarios, localized memory corruption that could be leveraged by a sophisticated adversary for arbitrary code execution.",
  "technicalDetails": "The root cause of this vulnerability lies in the macvlan_init() function, which historically only inherited hard_header_len from the lower device while defaulting needed_headroom and needed_tailroom to 0. This behavior assumes that the macvlan virtual interface does not require additional buffer space beyond the standard link-layer header, ignoring the requirements of the lower-level hardware or virtual drivers.\nMany modern Linux networking components—such as macsec, ipsec, wireguard, and certain veth configurations—require specific headroom/tailroom offsets to accommodate encapsulation headers or trailers. When a macvlan device is stacked on top of these, the higher-level kernel network stack calculates buffer requirements based on the macvlan device's misinformed metadata. Consequently, when dev_hard_header() or macvlan_hard_header() is invoked, the system may write data into an insufficiently sized buffer.\nThe exploitation flow typically occurs through the following sequence: 1) A macvlan interface is initialized over a lower device (e.g., a tunnel or encrypted interface) that mandates non-zero headroom/tailroom. 2) The macvlan device registers with the kernel, erroneously reporting zero-length headroom/tailroom. 3) The network stack prepares an skb for transmission, allocating space based on the macvlan's incorrect parameters. 4) As the packet travels down the stack, the lower-level driver attempts to prepend headers or append trailers that exceed the allocated space. 5) This triggers an skb headroom underflow, leading to memory corruption or out-of-bounds writes.\nThe vulnerability is further exacerbated by a lack of dynamic propagation. Even if the lower device changes its requirement via a NETDEV_FEAT_CHANGE event, the macvlan driver does not automatically update its attached upper devices, leaving them in a stale, vulnerable state. This persistent mismatch leads to repeated invalid memory accesses. The impact is significant, as these slab-use-after-free scenarios can be exploited to overwrite critical kernel object pointers or metadata, potentially enabling local privilege escalation if an attacker can manipulate the state of the slab allocator. Because this occurs within the core networking path, it is reachable by any process or user capable of generating network traffic through a correctly configured macvlan interface, requiring no specialized authentication other than the ability to manage network devices."
}