vxlan: use one headroom snapshot for neighbour replies
Summary
| CVE | CVE-2026-98568 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-10-18 16:17:09 UTC |
|---|
| Updated | 2026-10-19 10:19:14 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
vxlan: use one headroom snapshot for neighbour replies
vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
samples it again to reserve headroom. A concurrent vxlan_changelink() can
update needed_headroom between the two reads, creating a TOCTOU race. The
second value can exceed the allocation and make the Ethernet header write out
of bounds.
The race is reproducible on the unpatched kernel. It occurred when
vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed
the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte
skbuff_small_head allocation.
Snapshot the headroom once and use that value for both allocation and
reservation. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa 45a67662bf8ce3aa5643accf98d328dfbb47eaf6 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa 315d42ca39f69846662961c25dcf2bb07c350d14 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa a3c5eb6e382dd426a5e7eb08608897ed57167ff7 git |
Not specified |
| CNA |
Linux |
Linux |
affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa ff022fd9d0f0282c575e11778b96bd1b637503eb git |
Not specified |
| CNA |
Linux |
Linux |
affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa 481506a756dcd828ef42391cb08f38d8d96d38fc git |
Not specified |
| CNA |
Linux |
Linux |
affected d8be18c52dbc94989f6d74637b731af39cd3d902 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3927dace523706cc00f808520eaf2125dd7c07b5 git |
Not specified |
| CNA |
Linux |
Linux |
affected 3.12.18 3.13 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 3.13.10 3.14 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 3.14 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 3.14 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.158 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.112 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.55 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.9 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/a3c5eb6e382dd426a5e7eb08608897ed57167ff7 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/ff022fd9d0f0282c575e11778b96bd1b637503eb |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/315d42ca39f69846662961c25dcf2bb07c350d14 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/481506a756dcd828ef42391cb08f38d8d96d38fc |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/45a67662bf8ce3aa5643accf98d328dfbb47eaf6 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.