CVE-2025-71128High· 7.5▾ Twilight

erspan: Initialize options_len before referencing options.

In the Linux kernel, the following vulnerability has been resolved: erspan: Initialize options_len before referencing options. The struct ip_tunnel_info has a flexible array member named options that is protected by a counted_by(option…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jan 14, 2026

Updated

Oct 19, 2026

CVSS

7.5

Vendor

Linux

Product

Linux

CWE

—

Depth score

41 · Moderate

EPSS

0.31% · p24

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: yes
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 278 days

Jan 14, 2026Published
Disclosed via CVEORG
Oct 16, 2026EPSS first tracked
0.3%
Oct 19, 2026Record revised
Last analysed / modified upstream

Linux #cve.org

Affected

Linux >= bb5e62f2d547c4de6d1b144cbce2373a76c33f18 < b282b2a9eed848587c1348abdd5d83fa346a2743
Linux >= bb5e62f2d547c4de6d1b144cbce2373a76c33f18 < 35ddf66c65eff93fff91406756ba273600bf61a3
Linux 6.15

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

erspan: Initialize options_len before referencing options.

The struct ip_tunnel_info has a flexible array member named options that is protected by a counted_by(options_len) attribute.

The compiler will use this information to enforce runtime bounds checking deployed by FORTIFY_SOURCE string helpers.

As laid out in the GCC documentation, the counter must be initialized before the first reference to the flexible array member.

After scanning through the files that use struct ip_tunnel_info and also refer to options or options_len, it appears the normal case is to use the ip_tunnel_info_opts_set() helper.

Said helper would initialize options_len properly before copying data into options, however in the GRE ERSPAN code a partial update is done, preventing the use of the helper function.

Before this change the handling of ERSPAN traffic in GRE tunnels would cause a kernel panic when the kernel is compiled with GCC 15+ and having FORTIFY_SOURCE configured:

memcpy: detected buffer overflow: 4 byte write of buffer size 0

Call Trace: <IRQ> __fortify_panic+0xd/0xf erspan_rcv.cold+0x68/0x83 ? ip_route_input_slow+0x816/0x9d0 gre_rcv+0x1b2/0x1c0 gre_rcv+0x8e/0x100 ? raw_v4_input+0x2a0/0x2b0 ip_protocol_deliver_rcu+0x1ea/0x210 ip_local_deliver_finish+0x86/0x110 ip_local_deliver+0x65/0x110 ? ip_rcv_finish_core+0xd6/0x360 ip_rcv+0x186/0x1a0

Reported-at: https://launchpad.net/bugs/2129580

Affected

Linux >= bb5e62f2d547c4de6d1b144cbce2373a76c33f18 < b282b2a9eed848587c1348abdd5d83fa346a2743
Linux >= bb5e62f2d547c4de6d1b144cbce2373a76c33f18 < 35ddf66c65eff93fff91406756ba273600bf61a3
Linux 6.15

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

erspan: Initialize options_len before referencing options.

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

erspan: Initialize options_len before referencing options.

The struct ip_tunnel_info has a flexible array member named options that is protected by a counted_by(options_len) attribute.

The compiler will use this information to enforce runtime bounds checking deployed by FORTIFY_SOURCE string helpers.

As laid out in the GCC documentation, the counter must be initialized before the first reference to the flexible array member.

After scanning through the files that use struct ip_tunnel_info and also refer to options or options_len, it appears the normal case is to use the ip_tunnel_info_opts_set() helper.

Said helper would initialize options_len properly before copying data into options, however in the GRE ERSPAN code a partial update is done, preventing the use of the helper function.

Before this change the handling of ERSPAN traffic in GRE tunnels would cause a kernel panic when the kernel is compiled with GCC 15+ and having FORTIFY_SOURCE configured:

memcpy: detected buffer overflow: 4 byte write of buffer size 0