CVE-2026-89776

vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

State: Published
Severity: Not scored
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory.

Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before e12c4663529699f457b2988c1dfedf4d13b3b3beAffected f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before 47bfcc871576eaef6c8edab6749acd4b317306eaAffected f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before a9ec10815199f9879ba080241dc555efb1daf324Affected f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before daebc7064a1b4c12c98e52c4bceede7f2fcd573cAffected f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before ad32e564c62ebf5ba76dd60a22af52c69d54d17bAffected f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before 984f831dda31b3a18f47454cf64989f65402879eAffected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before e12c4663529699f457b2988c1dfedf4d13b3b3beAffected
f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before 47bfcc871576eaef6c8edab6749acd4b317306eaAffected
f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before a9ec10815199f9879ba080241dc555efb1daf324Affected
f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before daebc7064a1b4c12c98e52c4bceede7f2fcd573cAffected
f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before ad32e564c62ebf5ba76dd60a22af52c69d54d17bAffected
f9c4bb0b245cee35ef66f75bf409c9573d934cf9 to before 984f831dda31b3a18f47454cf64989f65402879eAffected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.