In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: IPIP tunnel hardware offload is not yet support
No driver supports for IPIP tunnels yet, give up early on setting up the hardware offload for this scenario.
This patch adds a stub that can be enhanced to add more configuration that are currently not supported. As of now, the offload work is enqueued to the worker, then ignored if the hardware offload configuration is not supported.
Check the NF_FLOW_HW flag to know if this entry was already tried once to be offloaded so this is not retried on refresh when unsupported. Move NF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag is unset the _del and _stats variants are never called.
This can be updated later on to skip hardware offload work to be queued in case hardware offload does not support it.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-7.0.0-31-generic-64kUpgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-gke-64k-7.0Upgrade linux-image-virtualUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-realtime-64kUpgrade linux-image-gke-hwe-26.04Upgrade linux-image-gkeUpgrade linux-image-virtual-7.0Upgrade linux-image-raspi-7.0Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-generic-64k-7.0Upgrade linux-image-raspi-realtime-7.0Upgrade linux-image-genericUpgrade linux-image-nvidia-bos-7.0Upgrade linux-image-generic-hwe-26.04Upgrade linux-image-7.0.0-1013-oemUpgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-oem-7.0Upgrade linux-image-nvidia-bosUpgrade linux-image-awsUpgrade linux-image-generic-7.0Upgrade linux-image-7.0.0-1012-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gke-7.0Upgrade linux-image-gcp-64kUpgrade linux-image-realtime-7.0Upgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-realtimeUpgrade linux-image-realtime-64k-7.0Upgrade linux-image-aws-64k-7.0Upgrade linux-image-aws-7.0Upgrade linux-image-oem-26.04aUpgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-aws-64kUpgrade linux-image-nvidia-7.0Upgrade linux-image-gcp-7.0Upgrade linux-image-gcpUpgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-raspi-realtimeUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-7.0.0-31-realtime-64kUpgrade linux-image-gke-64kUpgrade linux-image-nvidiaUpgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-7.0.0-2018-nvidia-bos-64kUpgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-generic-64kUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-raspiUpgrade linux-image-ibm-7.0Upgrade linux-image-oem-26.04bUpgrade linux-image-oem-26.04Upgrade linux-image-7.0.0-31-genericUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-virtual-hwe-26.04 | Sep 14, 2026 | Sep 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub