Executive brief
The Linux kernel's VXLAN virtual networking implementation contains a flaw in how it validates network configuration messages. When processing tunnel group address settings, the kernel reads uninitialized memory from the kernel's internal heap and returns this data to the user, potentially leaking sensitive information like encryption keys or network credentials that reside in adjacent memory.
Technical details
The vulnerability is an information disclosure (CWE-200) in the VXLAN VNI filter netlink attribute validation. The GROUP and GROUP6 attributes were declared with NLA_BINARY type but only specified a maximum length; validate_nla() accepted payloads shorter than a full IPv4 (4 bytes) or IPv6 (16 bytes) address. The consumer function nla_get_in_addr() performs an unconditional fixed-size read, causing a buffer over-read of uninitialized slab memory (up to 3 bytes) which is then stored in remote_ip and echoed back via RTM_GETTUNNEL netlink responses. The fix switches both attributes to NLA_POLICY_EXACT_LEN() to enforce strict length validation at the netlink layer. No special privileges or network reachability appear required for exploitation via local netlink messaging.
Affected products
- Linux Linux kernel multiple versions with VXLAN VNI filtering support (introduced in 5.15+)
Timeline
- 2026-09-16: disclosed: CVE-2026-89776 published
- 2026-08-17: patched: Upstream fix commit 984f831dda31b3a18f47454cf64989f65402879e merged
- 2026-09-14: patched: Stable tree backport commit 47bfcc871576eaef6c8edab6749acd4b317306ea