Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length. Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T13:17:52.060Z",
  "pubdate": "2026-08-15T13:17:52.060Z",
  "executiveSummary": "A buffer validation vulnerability exists in the Linux kernel's VXLAN networking subsystem, specifically within the route_shortcircuit() function. The flaw arises from improper use of buffer checking functions when dealing with non-linear network socket buffers (skb).\nThe vulnerability allows network packets with malformed or truncated network headers to bypass expected length checks. When route_shortcircuit() attempts to process these packets, it uses pskb_may_pull() relative to skb->data rather than accounting for the network header offset. Consequently, fields within the IP or IPv6 header residing in non-linear fragments are not correctly pulled into the linear buffer.\nThe primary impact of this vulnerability is a potential kernel out-of-bounds memory read when subsequent operations dereference network header fields, such as ip_hdr(skb)->daddr. This can lead to kernel memory disclosure, denial of service through kernel panics or crashes, or potentially affect system stability depending on the surrounding memory layout.\nThe affected component is the Linux kernel VXLAN implementation, specifically the routing short-circuit mechanism invoked during packet transmission in vxlan_xmit(). Attackers capable of injecting or forwarding specially crafted network traffic through a vulnerable VXLAN interface can trigger the condition. No specific authentication is required if the network interface processes untrusted or unvalidated ingress traffic.\nRisk implications include potential denial of service via kernel crashes caused by memory access faults. Mitigation requires applying the official kernel patch that replaces the incorrect buffer check with pskb_network_may_pull().",
  "technicalDetails": "The root cause of the vulnerability resides in incorrect boundary verification checks within the route_shortcircuit() function of the Linux kernel VXLAN subsystem. During packet transmission in vxlan_xmit(), the socket buffer pointer skb->data points directly to the MAC header, meaning that skb_network_offset(skb) accounts for the Ethernet header length, typically ETH_HLEN (14 bytes).\nHistorically, route_shortcircuit() invoked pskb_may_pull(skb, sizeof(struct iphdr)) or the corresponding IPv6 header size check. The function pskb_may_pull() validates that the specified number of bytes are contiguous and available starting strictly from skb->data. Because skb->data points to the MAC header rather than the network header, passing a size parameter such as 20 bytes only verifies 14 bytes of the MAC header plus an insufficient 6 bytes of the IP header. The remaining portion of the IP header remains un-pulled and may reside in non-linear socket buffer fragments.\nWhen subsequent code executes dereferences such as ip_hdr(skb)->daddr, the kernel attempts to read header fields that extend beyond the verified length of the linear buffer. If the network header spans non-linear fragments that were not brought into the linear skb data area, the access results in an out-of-bounds memory read or an invalid memory reference, precipitating a kernel panic or unexpected system behavior.\nTo exploit or trigger this condition, an attacker must cause the system to process packets where the network headers cross fragment boundaries in a non-linear skb layout while hitting the route short-circuit logic in the VXLAN driver. The attack flow involves transmitting malicious or malformed frames through the network interface that invoke vxlan_xmit() and subsequently route_shortcircuit(). Upon processing, the inadequate length check fails to pull the complete header into contiguous memory, leading to an unsafe pointer dereference during header field inspection.\nThe vulnerable component is the Linux kernel VXLAN driver, specifically within the route_shortcircuit() function interacting with pskb_may_pull(). The issue affects any Linux kernel version implementing this routing short-circuit logic prior to the application of the corrective patch. The attack vector is network-based, requiring the processing of VXLAN encapsulated or routed packets, and does not require local authentication or elevated privileges on the target system."
}