The Linux kernel IP tunnel devices derive their advertised needed_headroom from lower output devices. When multiple user-created devices are stacked, the derived needed_headroom value can exceed the representable range of 16-bit skb header offsets, leading to offset wrapping during skb head expansion in the IP output path. Although the runtime transmit path already caps needed_headroom growth at 512, the vulnerability was that the tunnel configuration could publish an unbounded needed_headroom value. The fix applies the same cap at the configuration stage, preventing the advertised value from exceeding 512. This prevents skb header offset wraparound and potential memory corruption or instability. The fix is safe and may cause extra reallocations in nonsensical stacked configurations but avoids unbounded reservations.

If unmitigated, the vulnerability could cause skb header offset wraparound due to oversized needed_headroom values in IP tunnel devices, potentially leading to memory corruption or kernel instability. The fix caps the advertised needed_headroom, preventing this condition. There are no known exploits in the wild. The impact is limited to kernel networking stack behavior with complex stacked IP tunnel devices.

A fix has been applied in the Linux kernel to cap the advertised needed_headroom value at 512 during tunnel configuration, preventing offset wraparound. Users should update to the patched kernel version containing this fix. No additional mitigation is required as the runtime transmit path already caps needed_headroom, and the fix ensures safe operation.