Executive brief
The Linux kernel's VXLAN networking module contains a race condition in packet processing that can cause the kernel to crash. When VXLAN tunnels are being torn down while incoming traffic is being processed, the kernel may attempt to access memory that has been freed, resulting in a denial of service that disrupts network connectivity for systems using VXLAN.
Technical details
This is a use-after-free / null-pointer dereference vulnerability in the vxlan_gro_prepare_receive() function within drivers/net/vxlan/vxlan_core.c. The root cause is a race condition where udp_tunnel_sock_release() can set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is concurrently processing incoming VXLAN packets. The vulnerable code dereferenced rcu_dereference_sk_user_data(sk) before checking if the result was NULL after skb_gro_remcsum_init(). The fix reorders operations to check for NULL after the remcsum initialization and before accessing the vxlan_sock structure. This is a local/network-accessible denial-of-service affecting systems with VXLAN tunneling enabled. Patches are available in upstream kernel and stable trees.
Affected products
- Linux Linux kernel 2.6.11 through 6.18 and later (prior to fix commit 30a45c0bffdd62350261e2f2689fdba426a33578)
Timeline
- 2026-08-15: disclosed
- 2026-05-05: patched: Upstream patch commit 30a45c0bffdd62350261e2f2689fdba426a33578