9.8

CVE-2026-80681

vxlan: re-fetch eth header after route_shortcircuit()

In the Linux kernel, the following vulnerability has been resolved:

vxlan: re-fetch eth header after route_shortcircuit()

Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).

Inside route_shortcircuit(), pskb_may_pull() can be called, which may
reallocate skb->head.

In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to
freed memory, leading to a use-after-free when dereferencing eth->h_dest.

Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version ae8840825605f36f98f247323edc150e761cb64e
Version < 6375093eb45cd7d89f1945f939eeae3b29d79f56
Status affected
Version ae8840825605f36f98f247323edc150e761cb64e
Version < 1b7f7b653e3557690047c62f03b80a24ea5a58a5
Status affected
Version ae8840825605f36f98f247323edc150e761cb64e
Version < bf045341dfb3e767f0ff94cf240ce3c371973bd4
Status affected
Version ae8840825605f36f98f247323edc150e761cb64e
Version < 2355c8c26d2aa1b4385b369e67202e47d460d555
Status affected
Version ae8840825605f36f98f247323edc150e761cb64e
Version < 1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585
Status affected
Version ae8840825605f36f98f247323edc150e761cb64e
Version < 1235e017aa11cf01e91b613c4c5ed6aa28934fff
Status affected
Version ae8840825605f36f98f247323edc150e761cb64e
Version < c9dceac9e1c7c772c43c732fc0d325e72835801a
Status affected
Version ae8840825605f36f98f247323edc150e761cb64e
Version < 1395a676ec15a0a02a2a6d86602324f2d5fd41d5
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.10
Status affected
Version 0
Version < 3.10
Status unaffected
Version <= 5.10.*
Version 5.10.265
Status unaffected
Version <= 5.15.*
Version 5.15.216
Status unaffected
Version <= 6.1.*
Version 6.1.183
Status unaffected
Version <= 6.6.*
Version 6.6.151
Status unaffected
Version <= 6.12.*
Version 6.12.103
Status unaffected
Version <= 6.18.*
Version 6.18.44
Status unaffected
Version <= 7.1.*
Version 7.1.8
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.41
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56
https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5
https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4
https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555
https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585
https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff
https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a
https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5