vxlan: use neigh_ha_snapshot() in route_shortcircuit()

Summary

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neigh_ha_snapshot() in route_shortcircuit() The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address. Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it. Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches.

Timeline

1. Aug 15, 2026, 12:27 PM UTCCVE published
2. Oct 16, 2026, 6:57 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 16, 2026, 7:05 PM UTCRecord last updated

Affected versions

• Linux Linux

  From e4f67addf158f98f8197e08974966b18480dc751 · fixed in 32a9590a8d30426e3db63e6b20893e47e02576c0; From e4f67addf158f98f8197e08974966b18480dc751 · fixed in d0993fc053f29e15cc7c9fe2029df3882a2ab5ab; From e4f67addf158f98f8197e08974966b18480dc751 · fixed in 87210054bad82bbae6f483a742dc45722fb47a6b; From e4f67addf158f98f8197e08974966b18480dc751 · fixed in d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0; From e4f67addf158f98f8197e08974966b18480dc751 · fixed in ec341bb76d77b4c2948764375ee6bfeef4bb41c3; From e4f67addf158f98f8197e08974966b18480dc751 · fixed in ff89415d34c3ab9f5312316423122e664ed3524f; From e4f67addf158f98f8197e08974966b18480dc751 · fixed in 05f2987f73daa05333fd713d05546142f9f7c5f0; From e4f67addf158f98f8197e08974966b18480dc751 · fixed in 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d

• Linux Linux

  3.8

• KernelLinux

  From 3.8.0 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.151; From 6.7.0 · fixed in 6.12.103; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8

References 8