CVE-2026-98568
Received Received - Intake

Buffer Overflow in Linux Kernel VXLAN

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan_changelink() can update needed_headroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds. The race is reproducible on the unpatched kernel. It occurred when vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuff_small_head allocation. Snapshot the headroom once and use that value for both allocation and reservation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98568
EUVD
EUVD-2026-103613

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
Linux Linux 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa
Linux Linux 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa
Linux Linux 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa
Linux Linux 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa
Linux Linux 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa
Linux Linux d8be18c52dbc94989f6d74637b731af39cd3d902
Linux Linux 3927dace523706cc00f808520eaf2125dd7c07b5
Linux Linux 3.12.18
Linux Linux 3.13.10
Linux Linux 3.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the Linux kernel's VXLAN (Virtual Extensible LAN) implementation. It occurs when vxlan_na_create() calculates the required headroom for a network reply packet twice. If vxlan_changelink() modifies the headroom between these calculations, the second value may exceed the allocated space, causing a buffer overflow. This can lead to memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's VXLAN implementation and may not have direct detection commands. Monitor kernel logs for KASAN reports or crashes related to vxlan_na_create() or vxlan_changelink(). Check for unusual network traffic patterns or skbuff allocation errors.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or corrupting memory. It may also enable privilege escalation if exploited to execute arbitrary code. Systems using VXLAN for network virtualization are particularly affected.

Compliance Impact

This vulnerability is a race condition in the Linux kernel's VXLAN implementation that could lead to memory corruption. It does not directly relate to data privacy or security controls required by GDPR or HIPAA, as it affects network packet handling rather than data storage or access.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update to a kernel version where vxlan_na_create() uses a single headroom snapshot. Monitor for crashes or memory corruption in VXLAN-related operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart