CVE-2026-98568
Received
Received - Intake
Buffer Overflow in Linux Kernel VXLAN
Vulnerability report for CVE-2026-98568, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use one headroom snapshot for neighbour replies
vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
samples it again to reserve headroom. A concurrent vxlan_changelink() can
update needed_headroom between the two reads, creating a TOCTOU race. The
second value can exceed the allocation and make the Ethernet header write out
of bounds.
The race is reproducible on the unpatched kernel. It occurred when
vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed
the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte
skbuff_small_head allocation.
Snapshot the headroom once and use that value for both allocation and
reservation.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa |
| Linux | Linux | 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa |
| Linux | Linux | 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa |
| Linux | Linux | 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa |
| Linux | Linux | 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa |
| Linux | Linux | d8be18c52dbc94989f6d74637b731af39cd3d902 |
| Linux | Linux | 3927dace523706cc00f808520eaf2125dd7c07b5 |
| Linux | Linux | 3.12.18 |
| Linux | Linux | 3.13.10 |
| Linux | Linux | 3.14 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
