Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98568

vxlan: use one headroom snapshot for neighbour replies

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 3.13, 3.14, 6.6.158, 6.12.112, 6.18.55, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan_changelink() can update needed_headroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds. The race is reproducible on the unpatched kernel. It occurred when vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuff_small_head allocation. Snapshot the headroom once and use that value for both allocation and reservation.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 3.12.18 · fixed in 3.13; From 3.13.10 · fixed in 3.14

  • Linux Linux

    3.14

  • KernelLinux

    From 3.14.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.55; From 6.19.0 · fixed in 7.2.9

References 8

git.kernel.org