CVE-2026-80615

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone

kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the

structure to the options_len, which is then initialized to zero.

Later, we're initializing the structure by copying the tunnel info

together with the options, and this triggers a warning for a potential

memcpy overflow, since the compiler estimates that the options can't

fit into the structure, even though the memory for them is actually

allocated.

memcpy: detected buffer overflow: 104 byte write of buffer size 96

WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report

skb_tunnel_info_unclone+0x179/0x190

geneve_xmit+0x7fe/0xe00

The issue is triggered when built with clang and source fortification.

Fix that by doing the copy in two stages: first - the main data with

the options_len, then the options. This way the correct length should

be known at the time of t

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References