The Linux kernel netfilter flowtable subsystem had a vulnerability where IPIP tunnel hardware offload was not supported due to no driver support, leading to early termination of hardware offload setup attempts. The patch adds a stub for future enhancements and prevents repeated offload attempts by checking the NF_FLOW_HW flag. This fix is part of a larger security update addressing multiple vulnerabilities across various kernel subsystems and architectures, including ARM64, x86, and others. The vulnerability has a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network exploitable with no privileges required and high impact on confidentiality, integrity, and availability. The vendor advisory from Ubuntu confirms the availability of patches in kernel versions 7.0.0-31.31 and later for the linux-hwe-edge package and related kernels. Users must update to these versions to remediate the issue.

The vulnerability allows an attacker to exploit the lack of hardware offload support for IPIP tunnels in the Linux kernel netfilter flowtable, potentially leading to system compromise. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability, with network attack vector and no required privileges. This could enable remote attackers to execute arbitrary code, escalate privileges, or cause denial of service. The issue is addressed in updated kernel packages, mitigating the risk when applied.

A patch is available and included in updated Linux kernel packages for the linux-hwe-edge and related kernels in Ubuntu 24.04 LTS and 26.04 LTS releases. Users should apply the standard system update and reboot to activate the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions for updating to the specified kernel versions (e.g., linux-image-7.0.0-31.31 and later). No additional mitigation is required once patched.