UBUNTU-CVE-2026-115538: Medium severity ubuntu/docker.io vulnerability
Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
To restore the encrypted overlay network rules after firewalld deletes them, remove the encrypted network's last local endpoint and add another endpoint, or restart dockerd.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Docker encrypted overlay networks are exposed when firewalld reloads or starts and deletes the associated iptables rules. Docker Engine networking components other than the overlay driver are not described as having this behavior.
What event triggers the loss of overlay-network protection?
A firewalld reload or start can delete the iptables rules used by encrypted overlay networks. The overlay driver does not handle these firewalld signals over D-Bus, so it does not restore the rules.
What is the security impact while the rules are missing?
Outgoing VXLAN datagrams can bypass IPsec encryption, and the protection against incoming cleartext VXLAN traffic is removed. Dockerd does not log this condition.
How can the condition be cleared if patching is not immediately possible?
Restart dockerd, or remove the encrypted network's last local endpoint and then add another endpoint. The condition otherwise persists, and can recur after each further firewalld event.