CVE-2026-97965
Received Received - Intake

Memory Corruption in Linux Kernel VXLAN Implementation

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: initialize _md in vxlan_xmit_one() If a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP, and a packet is transmitted through it using an external ip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left pointing to the uninitialized _md stack variable: if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) { if (info->options_len < sizeof(*md)) goto drop; md = ip_tunnel_info_opts(info); } Because IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains pointing to _md. Later, vxlan_build_skb() is called with md, which eventually calls vxlan_build_gbp_hdr(): if (vxflags & VXLAN_F_GBP) vxlan_build_gbp_hdr(vxh, md); Inside vxlan_build_gbp_hdr(), md->gbp is read: if (!md->gbp) return; gbp = (struct vxlanhdr_gbp *)vxh; ... if (md->gbp & VXLAN_GBP_DONT_LEARN) gbp->dont_learn = 1; If the stack contains garbage, this causes: 1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header. 2) gbp->dont_learn and gbp->policy_applied to be set from stack bits. 3) gbp->policy_id to receive 16 bits of uninitialized kernel stack data, leaking it onto the wire. Fix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not present, md->gbp remains 0, and vxlan_build_gbp_hdr() returns early without modifying the VXLAN header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97965
EUVD
EUVD-2026-86819

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where uninitialized memory in the VXLAN subsystem can leak kernel stack data. When a VXLAN device is configured with specific flags and a packet is transmitted without proper metadata flags, an uninitialized variable (_md) is used. This leads to garbage values being written into the VXLAN header, including policy IDs and control flags, which are then sent over the network.

Detection Guidance

This vulnerability affects the Linux kernel's VXLAN implementation when specific flags are set. Detection requires checking kernel version and VXLAN configurations. Use 'uname -a' to verify kernel version and inspect VXLAN device settings with 'ip -d link show'. Look for devices with VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP flags enabled.

Impact Analysis

This vulnerability could allow an attacker to leak sensitive kernel memory contents onto the network. The leaked data might include parts of kernel stack memory, which could contain sensitive information like passwords or cryptographic keys. It may also cause unexpected behavior in network devices due to malformed VXLAN headers.

Compliance Impact

This vulnerability could lead to data leaks, violating confidentiality requirements in GDPR and HIPAA. Exposure of sensitive data in network traffic may result in non-compliance with data protection regulations, potentially leading to legal and financial penalties for affected organizations.

Mitigation Strategies

Apply the kernel patch that initializes the _md variable in vxlan_xmit_one(). Update to a fixed kernel version if available. Disable VXLAN_F_GBP or VXLAN_F_COLLECT_METADATA flags if not required. Monitor network traffic for unexpected VXLAN header modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97965. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart