Executive brief
The Linux kernel's VXLAN networking module handles virtual network tunneling used in data center and cloud environments. A flaw in the forwarding database (FDB) flush operation could allow local code to read from and write to invalid memory when multiple network endpoints are flushed simultaneously, potentially causing system crashes or data corruption.
Technical details
The vulnerability is a use-after-free in the VXLAN FDB flush path (vxlan_fdb_flush_match_remotes). When a filtered bulk flush removes all remotes from an FDB entry, the code unlinks the last remote descriptor before destroying the parent FDB entry, violating the invariant that reachable entries must have at least one remote. An RCU reader can encounter the FDB during this window and call first_remote_rcu() on an empty list, dereferencing an invalid pointer. The fix checks if the remote list is singular before unlinking, and signals the caller to destroy the entire FDB entry instead. This requires local system access to trigger FDB flush operations on VXLAN interfaces.
Affected products
- Linux Linux kernel multiple versions prior to fix commit d5d4a7b538b52db63927773a8905fcd9f78a42e2
Timeline
- 2026-09-04: disclosed: CVE-2026-80838 published
- 2026-08-10: patched: Fix committed by Kyle Zeng and David Lee
- 2026-09-02: patched: Patch merged to stable kernel series