Executive brief
The Linux kernel's VXLAN network driver contains a use-after-free vulnerability in packet transmission. When the driver processes certain network packets, a pointer to the Ethernet header is cached but then becomes invalid after an internal function reallocates memory. Dereferencing this stale pointer can lead to a system crash or potentially allow an attacker with local or network access to execute arbitrary code.
Technical details
The vulnerability is a use-after-free in the vxlan_xmit() function within drivers/net/vxlan/vxlan_core.c. The Ethernet header pointer is obtained via eth_hdr(skb) before calling route_shortcircuit(), which internally calls pskb_may_pull() to ensure sufficient data in the packet buffer. pskb_may_pull() may reallocate skb->head, invalidating the previously cached eth pointer. After route_shortcircuit() returns, the stale eth pointer is dereferenced when accessing eth->h_dest, causing a use-after-free. The fix re-fetches the eth header pointer after route_shortcircuit() returns. The vulnerability affects VXLAN tunnel implementations that use L2 redirection with L3 switching. A patch was issued by upstream committer Eric Dumazet in late July 2026.
Affected products
- Linux Linux kernel Multiple versions including 4.x, 5.x, and 6.x series
Timeline
- 2026-08-28: disclosed: CVE-2026-80681 published on NVD
- 2026-07-27: patched: Upstream patch committed by Jakub Kicinski
- 2026-07-23: other: Fix authored by Eric Dumazet