Description

In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb->data. LWT programs cannot access the __sk_buff->data_meta pseudo-pointer to metadata. However, LWT encapsulation prepends outer headers, moving skb->data back over the headroom where the metadata sits. On an RX-originated (forwarded) packet that still carries XDP metadata this goes wrong in two different ways, depending on the encap type: 1. Non-BPF LWT encaps (mpls, seg6, ioam6 ...) call skb_push()/skb_pull() and silently overwrite the metadata that sits in the headroom. 2) BPF LWT xmit calls bpf_skb_change_head(), which uses skb_data_move(). That helper expects metadata immediately before skb->data. But since the IP output path runs LWT xmit before neighbour output has built the outgoing L2 header, for forwarded packets skb->data points at the L3 header while skb_mac_header() still points at the old L2 header. skb_data_move() sees metadata ending at skb_mac_header(), not before skb->data, warns and clears metadata: WARNING: CPU: 21 PID: 454557 at include/linux/skbuff.h:4609 skb_data_move+0x47/0x90 CPU: 21 UID: 0 PID: 454557 Comm: napi/iconduit-g Tainted: G O 6.18.21 #1 RIP: 0010:skb_data_move+0x47/0x90 Call Trace: <IRQ> bpf_skb_change_head+0xe6/0x1a0 bpf_prog_...+0x213/0x2e3 run_lwt_bpf.isra.0+0x1d3/0x360 bpf_xmit+0x46/0xe0 lwtunnel_xmit+0xa1/0xf0 ip_finish_output2+0x1e7/0x5e0 ip_output+0x63/0x100 __netif_receive_skb_one_core+0x85/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x2b/0x190 net_rx_action+0x40b/0x7f0 handle_softirqs+0xd2/0x270 do_softirq+0x3f/0x60 </IRQ> That is what happens, as for how to fix it - a received packet that carries metadata can reach an encap through any of the three LWT redirect modes: LWTUNNEL_STATE_INPUT_REDIRECT ip6_rcv_finish dst_input lwtunnel_input LWTUNNEL_STATE_OUTPUT_REDIRECT ip6_rcv_finish dst_input ip6_forward ip6_forward_finish dst_output lwtunnel_output LWTUNNEL_STATE_XMIT_REDIRECT ip6_rcv_finish dst_input ip6_forward ip6_forward_finish dst_output ip6_output ip6_finish_output ip6_finish_output2 lwtunnel_xmit Every encap funnels through the three LWT dispatch helpers, so drop the metadata there, right before handing the skb to the encap op. This single chokepoint covers all encap types and all three redirect modes: - lwtunnel_input(): seg6, rpl, ila, seg6_local - lwtunnel_output(): ioam6 - lwtunnel_xmit(): mpls, LWT BPF xmit Alternatively, we could clear the metadata right after TC ingress hook. That would require a compromise, however. Metadata would become inaccessible from TC egress (in setups where it actually reaches the hook it tact, that is without any L2 tunnels on path).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:45.183Z",
  "pubdate": "2026-08-28T08:16:45.183Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel networking subsystem where LightWeight Tunnel (LWT) encapsulation incorrectly processes XDP metadata stored in the socket buffer (skb) headroom.\nThe flaw allows the LWT encapsulation process to overwrite or mismanage critical XDP metadata during packet forwarding, leading to memory inconsistency and kernel warnings.\nAffected components include the LWT tunnel infrastructure (mpls, seg6, ioam6, and BPF LWT xmit), which fail to sanitize skb headroom before prepending encapsulation headers.\nThe risk involves potential system instability and kernel warnings triggered by the violation of skb_data_move assumptions during packet transit.\nThis issue primarily affects forwarded packets that carry XDP metadata, requiring no specific attacker authentication but necessitating control over the network path to trigger the LWT encapsulation flow.\nExploitation or accidental triggering of this vulnerability leads to integrity issues within the skb structure, potentially causing kernel crashes or denial-of-service conditions if memory offsets are incorrectly calculated by subsequent networking hooks.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper handling of the skb headroom, which is used to store XDP metadata for inter-process communication between XDP and TC (Traffic Control) hooks. In the Linux kernel networking stack, LWT encapsulation routines (such as mpls, seg6, and ioam6) perform skb_push() or skb_pull() operations to insert outer tunnel headers.\nThese operations move the skb->data pointer, which inherently conflicts with the location of the XDP metadata sitting in the skb headroom. The kernel incorrectly assumes the headroom is available for reuse without ensuring that existing metadata is purged.\nIn the case of BPF LWT xmit, the issue is compounded by the use of bpf_skb_change_head(), which calls skb_data_move(). This helper enforces a strict invariant: metadata must reside immediately before the current skb->data pointer. During the forwarding of a packet via LWT xmit, skb->data points to the L3 header while skb_mac_header() often refers to the stale L2 header. Consequently, skb_data_move() encounters a mismatch where metadata is not aligned as expected, triggering a kernel warning at include/linux/skbuff.h:4609 and forcing an abrupt clearing of metadata.\nThe attack flow involves an attacker sending a packet that is processed by an XDP hook, populating the metadata area, and is subsequently routed through a network path configured with LWT encapsulation. When the packet reaches the LWT dispatch helpers (lwtunnel_input, lwtunnel_output, or lwtunnel_xmit), the kernel performs the encapsulation without dropping the metadata. This leads to either the silent overwriting of data or the triggering of the safety warning in skb_data_move().\nThis vulnerability is present in the Linux kernel's handling of LWT redirection across all modes: LWTUNNEL_STATE_INPUT_REDIRECT, LWTUNNEL_STATE_OUTPUT_REDIRECT, and LWTUNNEL_STATE_XMIT_REDIRECT. Because these functions are the central chokepoints for all LWT-based tunnel operations, failing to drop the metadata at these points guarantees that corrupted metadata remains a persistent issue throughout the forwarding lifecycle for any packet originated via RX path XDP."
}