Description

In the Linux kernel, the following vulnerability has been resolved: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't fit into the structure, even though the memory for them is actually allocated. memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report skb_tunnel_info_unclone+0x179/0x190 geneve_xmit+0x7fe/0xe00 The issue is triggered when built with clang and source fortification. Fix that by doing the copy in two stages: first - the main data with the options_len, then the options. This way the correct length should be known at the time of the copy. It would be better if the options_len never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with options_len set to a non-zero value from the metadata_dst_alloc(). Another option would be to use ip_tunnel_info_opts_set(), but it is doing too many unnecessary operations for the use case here.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-28T08:16:45.523Z",
  "pubdate": "2026-08-28T08:16:45.523Z",
  "executiveSummary": "A false-positive buffer overflow vulnerability exists in the Linux kernel's tunnel metadata handling, specifically within the tun_dst_unclone function.\nThe vulnerability stems from a mismatch between compile-timeFORTIFY_SOURCE checks and the dynamic initialization of metadata structures.\nWhen using Clang with source fortification, the compiler incorrectly identifies a potential buffer overflow during a memcpy operation, as it assumes the initial zero-length state of the structure applies to the subsequent copy operation.\nWhile this is identified as a false-positive, it triggers a kernel panic or warning, causing a denial of service (DoS) in systems utilizing tunnel protocols like GENEVE.\nThe issue affects systems where the kernel is compiled with hardening enabled, impacting data plane operations for tunnel metadata.\nNo malicious exploitation is described; however, the triggered warning indicates a failure in robust memory management, which could lead to stability issues or system crashes under specific networking loads.",
  "technicalDetails": "The root cause of this vulnerability lies in the interaction between the metadata_dst_alloc() function and the fortification mechanisms enforced by Clang.\nmetadata_dst_alloc() utilizes kmalloc_flex() to allocate a flexible structure, tagging the options length via the __counted_by attribute. Initially, this length is set to zero to comply with the allocation sequence.\nSubsequent to this allocation, the kernel performs a memcpy operation to initialize the tunnel information, which includes the tunnel options. The compiler's static analysis tool, when source fortification is active, evaluates the destination buffer size against the initialized length of zero rather than the actual allocated size.\nThis mismatch results in a compiler-generated diagnostic: 'memcpy: detected buffer overflow: 104 byte write of buffer size 96', leading to a call to __fortify_report and a kernel warning/panic.\nThe attack flow—or more accurately, the fault trigger flow—is as follows: 1) A packet requiring tunnel encapsulation (e.g., GENEVE) reaches the kernel's transmit path. 2) The system attempts to clone or unclone the tunnel metadata via tun_dst_unclone. 3) The memory layout is initialized with a zero-length options field. 4) The kernel attempts to copy the full tunnel metadata, including valid options, into the destination buffer. 5) Clang’s fortify mechanism intercepts the memcpy, comparing the source size against the zeroed destination length, identifying an apparent buffer overflow, and triggering a kernel trap.\nThis highlights a deficiency in how the compiler tracks the state of flexible array members when they are updated incrementally after allocation. Because metadata_dst_alloc() separates the allocation and the population of the options length to avoid complex API returns, the compiler fails to maintain visibility of the actual allocated bounds during the initialization copy.\nThe fix involves decoupling the memory copy operation: performing a primary copy of the tunnel structure using the established options_len, followed by a secondary copy operation for the options themselves. By structuring the copy to align with the state known to the compiler’s fortification instrumentation, the developers ensure that the length checks remain within defined bounds, preventing the false-positive trigger.\nWhile this does not represent a traditional exploit vector, the resultant kernel warning leads to an immediate service interruption (DoS) on the affected network interface, effectively halting packet processing for tunnel-dependent traffic."
}