CVE-2026-80681

vxlan: re-fetch eth header after route_shortcircuit()

State: Published
Severity: 9.8 Critical
Published: Aug 28, 2026
Updated: Oct 16, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: re-fetch eth header after route_shortcircuit()

Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).

Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head.

In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest.

Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ae8840825605f36f98f247323edc150e761cb64e to before 6375093eb45cd7d89f1945f939eeae3b29d79f56Affected ae8840825605f36f98f247323edc150e761cb64e to before 1b7f7b653e3557690047c62f03b80a24ea5a58a5Affected ae8840825605f36f98f247323edc150e761cb64e to before bf045341dfb3e767f0ff94cf240ce3c371973bd4Affected ae8840825605f36f98f247323edc150e761cb64e to before 2355c8c26d2aa1b4385b369e67202e47d460d555Affected ae8840825605f36f98f247323edc150e761cb64e to before 1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585Affected ae8840825605f36f98f247323edc150e761cb64e to before 1235e017aa11cf01e91b613c4c5ed6aa28934fffAffected ae8840825605f36f98f247323edc150e761cb64e to before c9dceac9e1c7c772c43c732fc0d325e72835801aAffected ae8840825605f36f98f247323edc150e761cb64e to before 1395a676ec15a0a02a2a6d86602324f2d5fd41d5Affected
LinuxLinux	3.10Affected before 3.10Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ae8840825605f36f98f247323edc150e761cb64e to before 6375093eb45cd7d89f1945f939eeae3b29d79f56Affected
ae8840825605f36f98f247323edc150e761cb64e to before 1b7f7b653e3557690047c62f03b80a24ea5a58a5Affected
ae8840825605f36f98f247323edc150e761cb64e to before bf045341dfb3e767f0ff94cf240ce3c371973bd4Affected
ae8840825605f36f98f247323edc150e761cb64e to before 2355c8c26d2aa1b4385b369e67202e47d460d555Affected
ae8840825605f36f98f247323edc150e761cb64e to before 1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585Affected
ae8840825605f36f98f247323edc150e761cb64e to before 1235e017aa11cf01e91b613c4c5ed6aa28934fffAffected
ae8840825605f36f98f247323edc150e761cb64e to before c9dceac9e1c7c772c43c732fc0d325e72835801aAffected
ae8840825605f36f98f247323edc150e761cb64e to before 1395a676ec15a0a02a2a6d86602324f2d5fd41d5Affected

LinuxLinux

3.10Affected
before 3.10Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.