CVE-2026-98568

vxlan: use one headroom snapshot for neighbour replies

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use one headroom snapshot for neighbour replies

vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan_changelink() can update needed_headroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds.

The race is reproducible on the unpatched kernel. It occurred when vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuff_small_head allocation.

Snapshot the headroom once and use that value for both allocation and reservation.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before e3e24f4c434c56952412f875b834aa9daaa4fb15Affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before 9ed5a548b42d46e6968a46b67ca8a8e49b12a5a1Affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before fcaf456092dc86fd5b0b523ac27ec0d114066931Affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before 45a67662bf8ce3aa5643accf98d328dfbb47eaf6Affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before 315d42ca39f69846662961c25dcf2bb07c350d14Affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before a3c5eb6e382dd426a5e7eb08608897ed57167ff7Affected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before ff022fd9d0f0282c575e11778b96bd1b637503ebAffected 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before 481506a756dcd828ef42391cb08f38d8d96d38fcAffected d8be18c52dbc94989f6d74637b731af39cd3d902Affected 3927dace523706cc00f808520eaf2125dd7c07b5Affected 3.12.18 to before 3.13Affected 3.13.10 to before 3.14Affected
LinuxLinux	3.14Affected before 3.14Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before e3e24f4c434c56952412f875b834aa9daaa4fb15Affected
4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before 9ed5a548b42d46e6968a46b67ca8a8e49b12a5a1Affected
4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before fcaf456092dc86fd5b0b523ac27ec0d114066931Affected
4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before 45a67662bf8ce3aa5643accf98d328dfbb47eaf6Affected
4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before 315d42ca39f69846662961c25dcf2bb07c350d14Affected
4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before a3c5eb6e382dd426a5e7eb08608897ed57167ff7Affected
4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before ff022fd9d0f0282c575e11778b96bd1b637503ebAffected
4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa to before 481506a756dcd828ef42391cb08f38d8d96d38fcAffected
d8be18c52dbc94989f6d74637b731af39cd3d902Affected
3927dace523706cc00f808520eaf2125dd7c07b5Affected
3.12.18 to before 3.13Affected
3.13.10 to before 3.14Affected

LinuxLinux

3.14Affected
before 3.14Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.