Executive brief
A vulnerability was identified in the Linux kernel's VXLAN networking component, which is used to create virtual networks over physical infrastructure. A technical error in how the system handles network packet headers could lead to a 'use-after-free' condition, potentially causing system instability or crashes. This issue affects systems using VXLAN for network virtualization and has been resolved in recent kernel updates.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/net/vxlan/vxlan_core.c within the Linux kernel. The function vxlan_xmit_one() incorrectly reuses a cached pointer to the IP header (old_iph) after calling skb_tunnel_check_pmtu(). Because skb_tunnel_check_pmtu() can trigger a reallocation of the socket buffer (skb->head), the original pointer may become invalid. An attacker could potentially exploit this memory corruption to cause a kernel panic or achieve further impact depending on memory layout. The fix replaces the cached pointer with a direct call to ip_hdr(skb) to ensure the current memory location is used.
Affected products
- Linux Linux Kernel 5.9 to 6.14.y
Timeline
- 2026-05-25: disclosed: Initial patch submitted by Eric Dumazet
- 2026-06-09: patched: Patch committed to stable kernel branches
- 2026-07-19: advisory: CVE published in NVD dataset
References
- https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7
- https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb
- https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0
- https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf
- https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd
- https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a
- https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea