In the Linux kernel, the following vulnerability has been resolved: net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom, immediately before skb->data. LWT programs cannot access the __sk_buff->data_meta pseudo-pointer to metadata. However, LWT encapsulation prepends outer headers, moving skb->data back over the headroom where the metadata sits. On an RX-originated (forwarded) packet that still carries XDP metadata this goes wrong in two different ways, depending on the encap type: 1. Non-BPF LWT encaps (mpls, seg6, ioam6 ...) call skb_push()/skb_pull() and silently overwrite the metadata that sits in the headroom. 2) BPF LWT xmit calls bpf_skb_change_head(), which uses skb_data_move(). That helper expects metadata immediately before skb->data. But since the IP output path runs LWT xmit before neighbour output has built the outgoing L2 header, for forwarded packets skb->
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80612 is a critical vulnerability (CVSS 9.8) in the Linux kernel's lightweight tunnel (LWT) implementation that causes memory corruption through improper metadata handling. When LWT encapsulation prepends outer headers to network packets, it moves the skb->data pointer backward into the headroom region where XDP/TC metadata resides. On forwarded RX-originated packets, this creates a memory safety violation where metadata can be overwritten or leaked, potentially allowing attackers to corrupt kernel memory, escalate privileges, or achieve remote code execution. Systems running vulnerable Linux kernels that process forwarded traffic through LWT encapsulation—particularly in containerized, virtualized, or edge computing environments—face immediate exploitation risk.
While CVE-2026-80612 lacks specific MITRE ATT&CK mappings, Casky's Claude-powered analysis would identify this vulnerability pattern within the broader exploitation chain: initial network packet manipulation (T1040 - Traffic Duplication), followed by memory corruption leading to privilege escalation (T1548 - Abuse Elevation Control Mechanism) or code execution (T1203 - Exploitation for Client Execution). Extended reasoning across Casky's 754 mapped security skills enables practitioners to detect anomalous kernel memory access patterns in LWT processing paths, unusual packet forwarding behavior, and metadata corruption signatures in network telemetry. Security teams would observe findings focused on kernel memory protection violations, suggesting immediate patching of affected Linux distributions and network function virtualization platforms handling encapsulated traffic.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80612. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation