CVE-2024-26804: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26804 is a vulnerability in the Linux kernel's ip_tunnel infrastructure that can cause dev->needed_headroom to increment indefinitely. The vulnerability was discovered in early 2024 and affects the Linux kernel's networking stack (Kernel Git).

The vulnerability occurs in the ip_tunnel infrastructure where the needed_headroom value can grow without bounds. When packets are routed through nested tunnels (like GRE and IPIP), each tunnel's headroom requirements compound, leading to continuous growth of the needed_headroom value. This can eventually cause the skb->head/data distance to exceed 64KB, resulting in a wrap-around of the skb->network_header (u16) value during headroom expansion (Kernel Git).

When exploited, this vulnerability can cause skb->data to point to a memory location outside the skb->head allocated area, leading to a use-after-free condition. This occurs because when skb_network_offset() returns a negative offset, the unsigned __skb_pull() argument causes skb->data to be adjusted by a large value (NVD).

The vulnerability can be triggered when packets are routed through a specific configuration of nested tunnels. A proof-of-concept exists using syzkaller that demonstrates the issue by routing packets via a GRE tunnel with routes pointing to an IPIP tunnel (Kernel Git).

The issue has been fixed by implementing a cap on the needed_headroom value to prevent perpetual growth. A maximum allowed value of 512 was introduced to prevent overflow of header offsets in skb_headers_offset_update() (Kernel Git).