CVE-2026-98568: vxlan: use one headroom snapshot for neighbour replies
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use one headroom snapshot for neighbour replies
vxlannacreate() samples LLRESERVEDSPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink() can update neededheadroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds.
The race is reproducible on the unpatched kernel. It occurred when vxlannacreate() generated a neighbour reply while vxlanchangelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuffsmallhead allocation.
Snapshot the headroom once and use that value for both allocation and reservation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In vxlan_na_create(), snapshot LL_RESERVED_SPACE() once and use the same headroom value for both skbuff_small_head allocation and headroom reservation, preventing vxlan_changelink() from changing needed_headroom between the two reads.