All vulnerabilities
CVE-2026-98568

Linux: vxlan: use one headroom snapshot for neighbour replies

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in45a67662bf8ce3aa5643accf98d328dfbb47eaf6Also 315d42ca39f69846662961c25dcf2bb07c350d14, 481506a756dcd828ef42391cb08f38d8d96d38fc and 2 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use one headroom snapshot for neighbour replies

vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan_changelink() can update needed_headroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds.

The race is reproducible on the unpatched kernel. It occurred when vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuff_small_head allocation.

Snapshot the headroom once and use that value for both allocation and reservation.

Text from CVE List

Affected versions 16

  • Linuxaffected: 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa before 45a67662bf8ce3aa5643accf98d328dfbb47eaf6CVE List
  • Linuxaffected: 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa before 315d42ca39f69846662961c25dcf2bb07c350d14CVE List
  • Linuxaffected: 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa before a3c5eb6e382dd426a5e7eb08608897ed57167ff7CVE List
  • Linuxaffected: 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa before ff022fd9d0f0282c575e11778b96bd1b637503ebCVE List
  • Linuxaffected: 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa before 481506a756dcd828ef42391cb08f38d8d96d38fcCVE List
  • Linuxaffected: d8be18c52dbc94989f6d74637b731af39cd3d902CVE List
  • Linuxaffected: 3927dace523706cc00f808520eaf2125dd7c07b5CVE List
  • Linuxaffected: 3.12.18 before 3.13CVE List
  • Linuxaffected: 3.13.10 before 3.14CVE List
  • Linuxaffected: 3.14CVE List
  • Linuxunaffected: all versions before 3.14CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5