A vulnerability in the Linux kernel ip6_gre implementation allows a local, authenticated attacker to potentially cause privilege escalation or system crashes through improper memory handling.

The ip6gre_tnl_link_config_route function incorrectly accumulates the lower device hardware header length into the tunnel device header length. This logic error, which requires local user privileges (PR:L), can lead to heap-based memory corruption or denial of service conditions.

Successful exploitation of this vulnerability could allow a local attacker to escalate privileges or trigger a kernel panic, resulting in unauthorized system access or significant service downtime. Given the CVSS score of 7.8, this flaw represents a high risk to environment stability, particularly in shared hosting or multi-tenant environments where local users may exist.

Immediate Action: Apply the latest stable kernel patches provided by your distribution vendor, ensuring your kernel is updated to at least 5.10.270, 5.15.221, 6.1.188, or 6.6.157.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or recurring system restarts that may indicate attempted exploitation of kernel memory structures.

Compensating Controls: Restrict access to the system to only trusted users and minimize the use of GRE tunnels where not strictly necessary, as this reduces the attack surface for this specific component.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

This vulnerability presents a significant risk to the integrity and availability of Linux-based systems. Administrators should prioritize the deployment of the provided kernel security updates during the next maintenance cycle. Failure to patch may leave systems vulnerable to local privilege escalation attempts that could compromise the entire host operating system.