ipvlan Headroom UAF

Vulnerability analysis

When an ipvlan virtual device is created on top of a physical or lower device that requires extra packet headroom or tailroom (such as devices using macsec, ipsec, wireguard, tunnels, or veth with rx headroom), the ipvlan driver fails to inherit the needed headroom and tailroom values from the underlying device. As a result, the kernel's network stack underestimates the buffer space required when building packets through the ipvlan device. When a header is prepended or trailer data is appended, the socket buffer (skb) can underflow its headroom or overflow its tailroom, leading to a slab use-after-free detected by KASAN. The fix ensures ipvlan devices inherit the needed_headroom and needed_tailroom from their parent device at initialization time and whenever the parent's features change. This vulnerability is reachable locally by any user who can create network namespaces and configure ipvlan devices, which is possible with CAP_NET_ADMIN obtainable in a user namespace on most Linux distributions.