{"id":"CVE-2025-71128","title":"erspan: Initialize options_len before referencing options.","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nerspan: Initialize options_len before referencing options.\n\nThe struct ip_tunnel_info has a flexible array member named\noptions that is protected by a counted_by(option…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= bb5e62f2d547c4de6d1b144cbce2373a76c33f18 < b282b2a9eed848587c1348abdd5d83fa346a2743","Linux >= bb5e62f2d547c4de6d1b144cbce2373a76c33f18 < 35ddf66c65eff93fff91406756ba273600bf61a3","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:05:53.966037Z"},"published":"2026-01-14","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:09:46.999Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71128","references":[{"url":"https://git.kernel.org/stable/c/b282b2a9eed848587c1348abdd5d83fa346a2743"},{"url":"https://git.kernel.org/stable/c/35ddf66c65eff93fff91406756ba273600bf61a3"}],"tags":["cve.org"],"epss":0.00309,"epssPercentile":0.22135,"ingestedAt":"2026-10-16T17:24:46.635Z","slug":"CVE-2025-71128","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nerspan: Initialize options_len before referencing options.\n\nThe struct ip_tunnel_info has a flexible array member named\noptions that is protected by a counted_by(options_len)\nattribute.\n\nThe compiler will use this information to enforce runtime bounds\nchecking deployed by FORTIFY_SOURCE string helpers.\n\nAs laid out in the GCC documentation, the counter must be\ninitialized before the first reference to the flexible array\nmember.\n\nAfter scanning through the files that use struct ip_tunnel_info\nand also refer to options or options_len, it appears the normal\ncase is to use the ip_tunnel_info_opts_set() helper.\n\nSaid helper would initialize options_len properly before copying\ndata into options, however in the GRE ERSPAN code a partial\nupdate is done, preventing the use of the helper function.\n\nBefore this change the handling of ERSPAN traffic in GRE tunnels\nwould cause a kernel panic when the kernel is compiled with\nGCC 15+ and having FORTIFY_SOURCE configured:\n\nmemcpy: detected buffer overflow: 4 byte write of buffer size 0\n\nCall Trace:\n <IRQ>\n __fortify_panic+0xd/0xf\n erspan_rcv.cold+0x68/0x83\n ? ip_route_input_slow+0x816/0x9d0\n gre_rcv+0x1b2/0x1c0\n gre_rcv+0x8e/0x100\n ? raw_v4_input+0x2a0/0x2b0\n ip_protocol_deliver_rcu+0x1ea/0x210\n ip_local_deliver_finish+0x86/0x110\n ip_local_deliver+0x65/0x110\n ? ip_rcv_finish_core+0xd6/0x360\n ip_rcv+0x186/0x1a0\n\nReported-at: https://launchpad.net/bugs/2129580\n\n## Affected\n\n- `Linux >= bb5e62f2d547c4de6d1b144cbce2373a76c33f18 < b282b2a9eed848587c1348abdd5d83fa346a2743`\n- `Linux >= bb5e62f2d547c4de6d1b144cbce2373a76c33f18 < 35ddf66c65eff93fff91406756ba273600bf61a3`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}