[CVE-2026-80615][MODERATE REGULAR] net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone [ Upstream

[AL-KERNEL <alkernel@kernelcve.org>]

CVE: CVE-2026-80615
Priority: MODERATE REGULAR
AL-KERNEL base severity: MODERATE
KPANIC flag: NO
Patch: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone [ Upstream
Commit: 7ce31739fe88a558370135db95bbeec1e7ddfc29
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7ce31739fe88a558370135db95bbeec1e7ddfc29
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80615
Analysis date: Fri, 28 Aug 2026 06:58:12 -0400
ActionableScore: 3
ActionableScore lower bound: 1
Actionable bucket: Borderline Ordinary Moderate. Manual check recommended only for affected tunnel deployments with clang fortify or panic_on_warn
Manual review required: NO

Summary:
No one-sentence report phrase was found.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-80615 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80615

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE REGULAR
Manual review required: NO

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-80615	MODERATE	CHECK WITH IMPACT FROM ORIG NN MODERATE	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H';CWE-693;CWE-703;*CWE-664;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L';BEST CVSS score: '5.3';DESCR 'A FORTIFY false positive in tun_dst_unclone can report a memcpy overflow when tunnel metadata with options is copied in one operation. The allocation includes space for the options, but the counted_by length is observed as zero at the time of the combined copy, so clang source fortification may warn even though the backing memory is present. This can be reached in tunnel transmit paths such as geneve_xmit when an skb tunnel info object is uncloned. For the CVSS the PR:N is used only in the paranoid adjacent network interpretation because a remote or adjacent sender may be able to make a preconfigured gateway transmit matching tunneled traffic without a local account. In the normal local assessment PR:L is more appropriate because an attacker needs local ability to send traffic through an already configured tunnel path. Impact is availability only through WARN or panic_on_warn behavior. There is no supported confidentiality or integrity impact because the patch context indicates a false positive warning rather than a real out of bounds write or UAF primitive.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Borderline Ordinary Moderate. Manual check recommended only for affected tunnel deployments with clang fortify or panic_on_warn (with actual score 2)  SKIP CVE-2026-80615 UNKNOWN SKIP No affected files built, so skip this CVE NO  - - unknown 	MAYBE	REMOTE OOB HARDWARE LINUS  DECREASED_TO_MODERATE_REGULAR_FROM_MODERATE7_BASED_ON_GUESSCVSS_AND_CIANNH	-	-	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=3
ActionableScoreLower=1

1. ActionableScore
* Conservative score: 1
* Paranoid score: 3
* Final recommended bucket: **Borderline Ordinary Moderate. Manual check recommended only for affected tunnel deployments with clang fortify or panic_on_warn**

2. Signal breakdown
* Local unprivileged trigger: +1 conservative. A local user may be able to send traffic through an already configured tunnel path, but creating Geneve or tunnel metadata configuration normally requires admin privileges.
* Remote reachable / network-triggerable: +2 paranoid only. A remote or adjacent sender may be able to cause a preconfigured gateway to transmit matching tunneled traffic, but this is not ordinary remote protocol parsing by the vulnerable host.
* Reliable kernel crash / strong DoS: +1 paranoid only. The patch shows a FORTIFY warning, and this becomes a kernel crash mainly when panic_on_warn or similar policy is enabled.
* No generic memory corruption: +0. The commit explicitly describes a false positive. The allocation includes the option bytes and the patch only changes the copy shape so __counted_by and fortify see the correct size.
* No confidentiality or integrity impact: +0. There is no supported OOB write, UAF, stale pointer, object confusion, information leak, or attacker controlled overwrite target.
* Rare or configuration dependent path: -1 conservative. Triggering depends on clang plus source fortification and tunnel metadata uncloning, for example Geneve transmit.
* Special failure mode: -1 conservative. The visible failure is a warning unless the deployment treats WARN as fatal.

3. Reachability analysis
The realistic trigger is traffic that reaches skb_tunnel_info_unclone through a configured tunnel transmit path such as geneve_xmit. Local unprivileged users may trigger packet transmission only if the tunnel already exists and policy permits their traffic through it. Remote triggering is plausible only in the paranoid adjacent network or gateway scenario where an attacker can make the host transmit matching tunneled traffic. The affected path is not a default exposed Internet service. Namespace impact depends on whether tunnel setup or packet injection is delegated, but tunnel creation normally requires CAP_NET_ADMIN.

4. Severity interpretation
This behaves more like an ordinary Moderate or Low-like availability issue than an Important kernel vulnerability. Theoretical memory corruption is not supported because the commit explains that the destination allocation is large enough and that the warning comes from __counted_by visibility during a combined memcpy. Realistic impact is a WARN and possible DoS only on configurations where WARN is fatal or where repeated warnings materially affect service.

5. One-sentence report phrase
A FORTIFY false positive in tun_dst_unclone may warn during tunnel metadata option copying in paths such as geneve_xmit, with practical impact limited to availability on clang fortify builds or panic_on_warn systems and no supported evidence of real memory corruption.

6. Manual review recommendation
MANUAL CHECK RECOMMENDED. This should not be treated as an Important candidate, but manual review is reasonable for products using clang source fortification, Geneve or similar tunnel metadata, and panic_on_warn.

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone [ Upstream
Commit: 7ce31739fe88a558370135db95bbeec1e7ddfc29
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7ce31739fe88a558370135db95bbeec1e7ddfc29

Changed files:
  lib/string_helpers.c
  include/net/dst_metadata.h

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7ce31739fe88a558370135db95bbeec1e7ddfc29

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-80615 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-80615

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  The Best / paranoid CVSS vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS score: 5.3

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: 1
  Paranoid ActionableScore: 3

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: NO
Published priority for this report (same as in Subject): MODERATE REGULAR

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).