UBUNTU-CVE-2026-97965: Medium severity ubuntu/linux-aws vulnerability

In the Linux kernel, the following vulnerability has been resolved: vxlan: initialize md in vxlanxmitone() If a VXLAN device is configured with both VXLANFCOLLECTMETADATA and VXLANFGBP, and a packet is transmitted through it using an external iptunnelinfo that lacks the IPTUNNELVXLANOPTBIT flag, md is left pointing to the uninitialized md stack variable: if (testbit(IPTUNNELVXLANOPTBIT, info->key.tunflags)) { if (info->optionslen < sizeof(md)) goto drop; md = iptunnelinfoopts(info); } Because IPTUNNELVXLANOPTBIT is not set, md is not updated and remains pointing to md. Later, vxlanbuildskb() is called with md, which eventually calls vxlanbuildgbphdr(): if (vxflags & VXLANFGBP) vxlanbuildgbphdr(vxh, md); Inside vxlanbuildgbphdr(), md->gbp is read: if (!md->gbp) return; gbp = (struct vxlanhdrgbp )vxh; ... if (md->gbp & VXLANGBPDONTLEARN) gbp->dontlearn = 1; If the stack contains garbage, this causes: 1) VXLANHFGBP flag to be spuriously set in the VXLAN header. 2) gbp->dontlearn and gbp->policyapplied to be set from stack bits. 3) gbp->policyid to receive 16 bits of uninitialized kernel stack data, leaking it onto the wire. Fix this by zero-initializing md. If IPTUNNELVXLANOPTBIT is not present, md->gbp remains 0, and vxlanbuildgbphdr() returns early without modifying the VXLAN header.