Executive brief
The Linux kernel's vxlan (Virtual Extensible LAN) multicast database has a bug that can corrupt the source list when replacing multicast entries fails partway through. An attacker on a local network or with network access could exploit this to incorrectly forward or block multicast traffic, potentially disrupting network services that rely on precise multicast filtering.
Technical details
This is a logic error in vxlan_mdb_remote_srcs_add() that manifests during source list replacement operations on VXLAN MDB (Multicast Database) remote entries. When replacing a source list, existing sources are marked for deletion, new sources are added via vxlan_mdb_remote_srcs_add(), and pre-existing sources have their deletion mark cleared. If vxlan_mdb_remote_srcs_add() fails partway through, its error path deletes all sources on the remote's list—but this is destructive on the replace path where pre-existing sources should be preserved. The fix introduces a VXLAN_SGRP_F_NEW flag to mark only newly-created entries, ensuring that on failure, only those new entries are rolled back and pre-existing sources remain untouched. This prevents unintended changes to (S, G) forwarding rules that can cause EXCLUDE filters to incorrectly forward blocked traffic or INCLUDE filters to drop allowed traffic.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-08-10: disclosed