{
  "cveId": "CVE-2026-80615",
  "url": "https://patchblox.com/security/cve/CVE-2026-80615",
  "summary": "CVE-2026-80615 is fixed in linux on 1 platform by DEBIAN-CVE-2026-80615 (version 7.1.5-1), released August 29, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net: dst_metadata: fix false-positive memcpy ove...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone  kmalloc_flex() in metadata_dst_alloc() sets __counted_by for the structure to the options_len, which is then initialized to zero. Later, we\u0027re initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can\u0027t fit into the structure, even though the memory for them is actually allocated.   memcpy: detected buffer overflow: 104 byte write of buffer size 96  WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 __fortify_report   skb_tunnel_info_unclone\u002B0x179/0x190   geneve_xmit\u002B0x7fe/0xe00  The issue is triggered when built with clang and source fortification.  Fix that by doing the copy in two stages: first - the main data with the options_len, then the options.  This way the correct length should be known at the time of the copy.  It would be better if the options_len never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with options_len set to a non-zero value from the metadata_dst_alloc().  Another option would be to use ip_tunnel_info_opts_set(), but it is doing too many unnecessary operations for the use case here.",
  "published": "2026-08-28T08:16:45Z",
  "severity": "high",
  "cvss": 8.2,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
  "epss": 0.00489,
  "epssPercentile": 0.42348,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-80615",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-80615",
      "released": "2026-08-29T00:46:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}