CVE-2026-89776: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla() accepts a payload shorter than the address. The GROUP consumer reads it with nlagetinaddr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remoteip and echoed back via RTMGETTUNNEL, disclosing kernel memory.
Switch both entries to NLAPOLICYEXACTLEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Switch both GROUP and GROUP6 entries from NLA_BINARY with only a maximum length to NLA_POLICY_EXACT_LEN(), so attributes shorter or longer than the full address width are rejected.
Linux kernel VXLAN VNI filter GROUP/GROUP6 attribute validation policy = NLA_POLICY_EXACT_LEN(4 bytes for GROUP; 16 bytes for GROUP6)
Event History
Frequently Asked Questions
Who can trigger the information disclosure?
An attacker needs to submit a VXLAN VNI filter entry containing a malformed, undersized GROUP or GROUP6 netlink attribute. The issue is in the VXLAN VNI filter configuration path, so systems that do not use or expose this configuration path are not described as affected by the provided data.
What information can be disclosed?
A short GROUP attribute can cause an unconditional 4-byte read that includes up to 3 bytes of uninitialized slab data. Those bytes are stored in remote_ip and can be returned through RTM_GETTUNNEL.
How does the fix prevent exploitation?
The fix changes GROUP and GROUP6 validation to require exact attribute lengths: 4 bytes for GROUP and 16 bytes for GROUP6. Malformed shorter attributes are rejected before their address values are read.