In the Linux kernel, the following vulnerability has been resolved:
erspan: do not assume transport header is always set
Rewrite tests in ip6erspan_tunnel_xmit() and erspan_fb_xmit() to not assume transport header is set.
syzbot reported:
WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 skb_transport_header include/linux/skbuff.h:2911 [inline] WARNING: CPU: 0 PID: 1350 at include/linux/skbuff.h:2911 ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 Modules linked in: CPU: 0 PID: 1350 Comm: aoe_tx0 Not tainted 5.19.0-rc2-syzkaller-00160-g274295c6e53f #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:skb_transport_header include/linux/skbuff.h:2911 [inline] RIP: 0010:ip6erspan_tunnel_xmit+0x15af/0x2eb0 net/ipv6/ip6_gre.c:963 Code: 0f 47 f0 40 88 b5 7f fe ff ff e8 8c 16 4b f9 89 de bf ff ff ff ff e8 a0 12 4b f9 66 83 fb ff 0f 85 1d f1 ff ff e8 71 16 4b f9 <0f> 0b e9 43 f0 ff ff e8 65 16 4b f9 48 8d 85 30 ff ff ff ba 60 00 RSP: 0018:ffffc90005daf910 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff88801f032100 RSI: ffffffff882e8d3f RDI: 0000000000000003 RBP: ffffc90005dafab8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff888024f21d40 R13: 000000000000a288 R14: 00000000000000b0 R15: ffff888025a2e000 FS: 0000000000000000(0000) GS:ffff88802c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e425000 CR3: 000000006d099000 CR4: 0000000000152ef0 Call Trace: <TASK> __netdev_start_xmit include/linux/netdevice.h:4805 [inline] netdev_start_xmit include/linux/netdevice.h:4819 [inline] xmit_one net/core/dev.c:3588 [inline] dev_hard_start_xmit+0x188/0x880 net/core/dev.c:3604 sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342 __dev_xmit_skb net/core/dev.c:3815 [inline] __dev_queue_xmit+0x14a1/0x3900 net/core/dev.c:4219 dev_queue_xmit include/linux/netdevice.h:2994 [inline] tx+0x6a/0xc0 drivers/block/aoe/aoenet.c:63 kthread+0x1e7/0x3b0 drivers/block/aoe/aoecmd.c:1229 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.130-118.517Upgrade kernel-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.54-25.126Upgrade kernel-tools-debuginfoUpgrade kernel | Mar 14, 2025 | Feb 26, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade python3-perf | Jul 11, 2025 | Feb 26, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools | Jul 1, 2025 | Feb 26, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-iotUpgrade linux-gcp-5.4Upgrade linux-gkeopUpgrade linux-aws-fipsUpgrade linux-riscv-5.15Upgrade linux-intel-iotgUpgrade linux-oracleUpgrade linux-gcp-5.15Upgrade linux-azure-5.4Upgrade linux-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-hwe-5.4Upgrade linux-nvidiaUpgrade linux-gcp-fipsUpgrade linux-lowlatencyUpgrade linux-oracle-5.15Upgrade linux-azure-5.15Upgrade linuxUpgrade linux-azure-fipsUpgrade linux-ibmUpgrade linux-ibm-5.4Upgrade linux-kvmUpgrade linux-raspi-5.4Upgrade linux-raspiUpgrade linux-oracle-5.4Upgrade linux-awsUpgrade linux-bluefieldUpgrade linux-gkeUpgrade linux-realtimeUpgrade linux-azureUpgrade linux-aws-5.15Upgrade linux-gcpUpgrade linux-aws-5.4Upgrade linux-hwe-5.15Upgrade linux-lowlatency-hwe-5.15 | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub