CVE-2026-89776: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla() accepts a payload shorter than the address. The GROUP consumer reads it with nlagetinaddr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remoteip and echoed back via RTMGETTUNNEL, disclosing kernel memory.
Switch both entries to NLAPOLICYEXACTLEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the information disclosure?
An attacker needs to submit a VXLAN VNI filter entry containing a malformed, undersized GROUP or GROUP6 netlink attribute. The issue is in the VXLAN VNI filter configuration path, so systems that do not use or expose this configuration path are not described as affected by the provided data.
What information can be disclosed?
A short GROUP attribute can cause an unconditional 4-byte read that includes up to 3 bytes of uninitialized slab data. Those bytes are stored in remote_ip and can be returned through RTM_GETTUNNEL.
How does the fix prevent exploitation?
The fix changes GROUP and GROUP6 validation to require exact attribute lengths: 4 bytes for GROUP and 16 bytes for GROUP6. Malformed shorter attributes are rejected before their address values are read.