Technical Summary

The Linux kernel contained a vulnerability in the IPv4 GRE (Generic Routing Encapsulation) code, specifically in the ipgre_header() function. Over time, syzbot fuzzing discovered multiple ways to crash the kernel due to improper handling of dynamic changes in device header lengths (dev->needed_headroom and dev->hard_header_len). This could lead to kernel panics caused by invalid skb (socket buffer) allocations with insufficient headroom, resulting in a BUG triggered in skbuff.c. The vulnerability was fixed by making ipgre_header() more robust, analogous to a prior fix in the IPv6 GRE code. The issue affects multiple Linux kernel versions prior to the patched releases in the 5.15 series and others as listed. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity) with local attack vector, low complexity, requiring low privileges, no user interaction, and impacts availability only. No known exploits in the wild have been reported. Ubuntu has released patches for affected kernel versions, including those for NVIDIA Tegra and other platforms, requiring system updates and reboot.