CVE-2026-98568: vxlan: use one headroom snapshot for neighbour replies
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use one headroom snapshot for neighbour replies
vxlannacreate() samples LLRESERVEDSPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink() can update neededheadroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds.
The race is reproducible on the unpatched kernel. It occurred when vxlannacreate() generated a neighbour reply while vxlanchangelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuffsmallhead allocation.
Snapshot the headroom once and use that value for both allocation and reservation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.9-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.55 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.9 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.159.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In vxlan_na_create(), snapshot LL_RESERVED_SPACE() once and use the same headroom value for both reply skb allocation and headroom reservation.
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The race requires vxlan_na_create() to generate a neighbour reply while a concurrent vxlan_changelink() changes the VXLAN link's needed headroom. The inconsistent headroom reads can cause the Ethernet header write to exceed the allocated skb space.
How can I determine whether a system may be affected?
Systems running an unpatched Linux kernel with VXLAN in use may be affected when neighbour replies and VXLAN link headroom changes occur concurrently. The reported reproduction was detected by KASAN as a four-byte write beyond a skbuff_small_head allocation.
What is the remediation?
Apply a kernel update containing the fix that snapshots the headroom value once and uses that same value for both reply skb allocation and headroom reservation. The provided stable-kernel references identify commits containing the correction.