CVE-2025-71128: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71128 is a denial-of-service vulnerability in the Linux kernel's GRE ERSPAN code path caused by improper initialization of the options_len field in the ip_tunnel_info structure before referencing its flexible array member options. Affected versions include Linux kernel 6.15 through 6.18.3 and 6.19-rc1 through 6.19-rc8. The vulnerability was published on January 14, 2026, and received an initial CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is an uninitialized counter (options_len) in struct ip_tunnel_info before the first reference to its counted_by-annotated flexible array member options (CWE classified as insufficient information by NVD). The normal code path uses the ip_tunnel_info_opts_set() helper, which initializes options_len before copying data into options; however, the GRE ERSPAN receive path (erspan_rcv) performs a partial update that bypasses this helper. When the kernel is compiled with GCC 15+ and FORTIFY_SOURCE enabled, the compiler's runtime bounds checking detects a buffer overflow during the memcpy operation and triggers __fortify_panic, resulting in a kernel panic with the message memcpy: detected buffer overflow: 4 byte write of buffer size 0 (Feedly, NVD).

Successful exploitation causes a kernel panic (system crash) on affected Linux systems that receive ERSPAN traffic over GRE tunnels, resulting in a complete denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Systems acting as GRE/ERSPAN tunnel endpoints compiled with GCC 15+ and FORTIFY_SOURCE are at risk of crashing upon receipt of ERSPAN packets, which could be triggered remotely by sending crafted network traffic (Feedly).

• Logs: Kernel panic messages containing memcpy: detected buffer overflow: 4 byte write of buffer size 0 in system logs (/var/log/kern.log, dmesg).
• Logs: Stack traces referencing __fortify_panic, erspan_rcv.cold, gre_rcv, ip_protocol_deliver_rcu, and ip_local_deliver in kernel logs.
• Network: Unexpected volume of ERSPAN-encapsulated GRE traffic (IP protocol 47) directed at the affected host, particularly from external or untrusted sources.
• System: Sudden system reboots or kernel oops events on hosts configured as GRE/ERSPAN tunnel endpoints.

Update the Linux kernel to version 6.18.4 or later, which includes the fix. Patches are available in the kernel stable repository at commits 35ddf66c65eff93fff91406756ba273600bf61a3 and b282b2a9eed848587c1348abdd5d83fa346a2743 (Feedly, kernel.org patch 1, kernel.org patch 2). As a temporary workaround where patching is not immediately possible, organizations can avoid compiling the kernel with GCC 15+ or disable FORTIFY_SOURCE, though these are not recommended long-term solutions. Organizations using GRE ERSPAN tunnels should prioritize this update.

The vulnerability was originally reported via the Ubuntu Launchpad bug tracker (bug #2129580), indicating it was discovered through real-world testing of GCC 15 compatibility with the Linux kernel. German Linux news outlet Pro-Linux.de covered the issue in multiple security advisories for Linux updates. No significant broader media coverage or notable researcher commentary beyond standard kernel security channels has been identified (Feedly).