CVE-2026-64410: netfilter: flowtable: IPIP tunnel hardware offload is not yet support

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: IPIP tunnel hardware offload is not yet support

No driver supports for IPIP tunnels yet, give up early on setting up the
hardware offload for this scenario.

This patch adds a stub that can be enhanced to add more configuration
that are currently not supported. As of now, the offload work is
enqueued to the worker, then ignored if the hardware offload
configuration is not supported.

Check the NF_FLOW_HW flag to know if this entry was already tried once
to be offloaded so this is not retried on refresh when unsupported. Move
NF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag
is unset the _del and _stats variants are never called.

This can be updated later on to skip hardware offload work to be queued
in case hardware offload does not support it.

The Linux kernel CVE team has assigned CVE-2026-64410 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.19 with commit ab427db17885814069bae891834f20842f0ac3a4 and fixed in 7.1.4 with commit 9efe838c13133acb70c78d04c49e8362fe533566
	Issue introduced in 6.19 with commit ab427db17885814069bae891834f20842f0ac3a4 and fixed in 7.2-rc3 with commit 6c5dcab95f4cd42a1648739ec9300fbb4b1a021f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64410
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/netfilter/nf_flow_table.h
	net/netfilter/nf_flow_table_core.c
	net/netfilter/nf_flow_table_offload.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9efe838c13133acb70c78d04c49e8362fe533566
	https://git.kernel.org/stable/c/6c5dcab95f4cd42a1648739ec9300fbb4b1a021f