CVE-2026-98122

Undergoing Analysis Undergoing Analysis - In Progress

Use-After-Free in Linux Kernel VXLAN MDB

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every MDBE_ATTR_SRC_LIST member, accepts the all-zeros address. A source list is only accepted on a (*, G) entry, whose source is the all-zeros address, and for each member of the list an (S, G) entry is derived from it by substituting the source. Entries are keyed by a plain memcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present and holds the all-zeros address and the source list holds it as well, the derived (S, G) key is byte-identical to the (*, G) key and resolves to the same entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is then left with a zero address family. vxlan_mdb_remote_src_del() removes the forwarding entry of a source before freeing the source entry: vxlan_mdb_remote_src_fwd_del(vxlan, group, remote, &ent->addr); vxlan_mdb_remote_src_entry_del(ent); With the keys aliased, the first call deletes the remote of the entry that owns 'ent' instead of a separate (S, G) entry, and frees 'ent'. The second call then runs on the freed entry, and its hlist_del() reads ->pprev and ->next out of it and writes through them. Adding the (*, G) entry with NLM_F_REPLACE and no source list marks the all-zeros source for deletion and reaches this from the sweep at the end of vxlan_mdb_remote_srcs_replace(). BUG: KASAN: slab-use-after-free in __vxlan_mdb_add+0x1cd/0xd70 Read of size 8 at addr ffff888102852500 by task poc/84 __vxlan_mdb_add+0x1cd/0xd70 vxlan_mdb_add+0xc0/0x140 rtnl_mdb_add+0x157/0x2a0 rtnetlink_rcv_msg+0x207/0x5a0 Allocated by task 84: __kmalloc_cache_noprof+0x153/0x360 vxlan_mdb_remote_srcs_add+0x2eb/0x440 __vxlan_mdb_add+0x803/0xd70 Freed by task 84: kfree+0x14c/0x3b0 vxlan_mdb_remote_del+0x129/0x1a0 __vxlan_mdb_del+0x4f/0xe0 vxlan_mdb_remote_src_fwd_del.isra.0+0x162/0x1b0 __vxlan_mdb_add+0x1c5/0xd70 The MDB operations are netns-scoped, so an unprivileged user can perform them in a new user and network namespace. Reject the all-zeros address in vxlan_mdb_is_valid_source(), which covers both call sites. A (*, G) entry is expressed by omitting the source, so nothing legitimate is refused. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98122

EUVD

EUVD-2026-86953

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's VXLAN module. It occurs when the vxlan_mdb_remote_src_del function removes a forwarding entry and then tries to free the source entry. If certain conditions are met, the keys for different entries become identical, causing the wrong entry to be deleted and freed prematurely. Subsequent operations then access the freed memory, leading to a use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's VXLAN MDB (Multicast Database) handling. Detection requires checking kernel logs for slab-use-after-free errors related to vxlan_mdb operations. Monitor logs for KASAN reports mentioning vxlan_mdb_add or vxlan_mdb_remote_src_del. Use commands like 'dmesg | grep -i vxlan' or 'journalctl -k | grep -i vxlan' to search for relevant errors.

Impact Analysis

An unprivileged user in a new user and network namespace could exploit this to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. The vulnerability allows memory corruption through improper handling of network configuration operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the Linux VXLAN subsystem. It could potentially lead to unauthorized access or data leaks if exploited, which may indirectly impact compliance by compromising system integrity or confidentiality. However, no specific compliance implications are documented in the provided context.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue. Update to a kernel version containing the fix for vxlan_mdb_remote_src_del() and vxlan_mdb_is_valid_source(). If immediate patching is not possible, restrict unprivileged user access to network namespaces and VXLAN MDB operations via kernel parameters or SELinux policies.

Hi! I’m here to help you understand CVE-2026-98122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70