CVE-2026-80615

In the Linux kernel, the following vulnerability has been resolved:

net: dstmetadata: fix false-positive memcpy overflow in tundst_unclone

kmallocflex() in metadatadst_alloc() sets __countedby for the structure to the optionslen, which is then initialized to zero. Later, we're initializing the structure by copying the tunnel info together with the options, and this triggers a warning for a potential memcpy overflow, since the compiler estimates that the options can't fit into the structure, even though the memory for them is actually allocated.

memcpy: detected buffer overflow: 104 byte write of buffer size 96 WARNING: CPU: X PID: Y at lib/string_helpers.c:1036 _fortifyreport skbtunnelinfounclone+0x179/0x190 genevexmit+0x7fe/0xe00

The issue is triggered when built with clang and source fortification.

Fix that by doing the copy in two stages: first - the main data with the options_len, then the options. This way the correct length should be known at the time of the copy.

It would be better if the optionslen never changed after allocation, but the allocation code is a little separate from the initialization and it would be awkward and potentially dangerous to return a struct with optionslen set to a non-zero value from the metadatadstalloc().

Another option would be to use iptunnelinfooptsset(), but it is doing too many unnecessary operations for the use case here.