CVE-2025-71128

The CVE impacts the Linux kernel’s GRE ERSPAN handling in ip_tunnel_info. A flaw in the erspan path leaves options_len uninitialized before any access to the flexible array member options, breaking the runtime bounds checks enforced by FORTIFY_SOURCE when GCC 15+ is used. This can trigger a kerne...

CVE-2025-71128 erspan: Initialize options_len before referencing options.

In the Linux kernel, the following vulnerability has been resolved: erspan: Initialize optionslen before referencing options. The struct iptunnelinfo has a flexible array member named options that is protected by a countedbyoptionslen attribute. The compiler will use this information to enforce...

CVE-2025-71128 erspan: Initialize options_len before referencing options.

In the Linux kernel, the following vulnerability has been resolved: erspan: Initialize optionslen before referencing options. The struct iptunnelinfo has a flexible array member named options that is protected by a countedbyoptionslen attribute. The compiler will use this information to enforce...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from uninitialized optionslen and could lead to out-of-bounds access...