The Linux kernel's net/ip6_tunnel code did not limit the growth of the needed_headroom buffer for IPv6 tunnels, unlike the IPv4 tunnel implementation which had a ceiling applied in a prior commit. This flaw could cause perpetual growth of the tunnel headroom, potentially leading to resource exhaustion and impacting confidentiality, integrity, and availability. The fix involves applying the same headroom adjustment limits to the IPv6 tunnel as exist for IPv4 tunnels. The vulnerability was identified and debugged by Francesco Ruggeri, who also contributed a patch and reproducer.

The vulnerability allows an attacker with local privileges to cause unbounded growth of the IPv6 tunnel headroom buffer, potentially leading to denial of service through resource exhaustion. The CVSS vector indicates high impact on confidentiality, integrity, and availability, though exploitation requires local access and low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided in this data, users should monitor for updates from the Linux kernel maintainers and apply any official fixes once available. Until then, limiting local access and monitoring resource usage may help mitigate risk.