Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() for transmit path header pulls In vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get(), pskb_may_pull() was being called to verify the availability of network layer headers (ARP, IPv6/ND, IP/IPv6 MDB keys). However, during transmit skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, len) only checks len bytes from skb->data rather than skb_network_offset(skb) + len, which can leave part of the network header in non-linear frags. Replace these remaining pskb_may_pull() calls with pskb_network_may_pull() to properly account for the MAC header offset.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T13:17:52.177Z",
  "pubdate": "2026-08-15T13:17:52.177Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel's VXLAN networking subsystem related to insufficient boundary checks during the transmit path header pull operations.\nThe vulnerability type is an incorrect buffer validation leading to potential out-of-bounds memory access or malformed packet handling.\nThe impact includes potential denial of service, memory corruption, or information disclosure depending on how downstream packet parsing handles non-linear fragments.\nAffected systems include any Linux kernel implementations utilizing the VXLAN subsystem where transmit-path functions such as vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() process socket buffers.\nRisk implications center around network-based attackers capable of triggering faulty packet transmission paths or injecting specific traffic payloads that interact with the vulnerable VXLAN encapsulation and reduction routines.\nExploitation requires the ability to send or route specific network traffic through a vulnerable Linux kernel host configured with VXLAN interfaces, relying on the kernel's internal handling of non-linear socket buffer fragments.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper use of the pskb_may_pull() function instead of pskb_network_may_pull() within the transmit path functions vxlan_xmit(), arp_reduce(), and vxlan_mdb_entry_skb_get() in the Linux kernel VXLAN subsystem.\nDuring the transmission phase, the socket buffer pointer skb->data points directly to the MAC header, meaning that the network header offset skb_network_offset(skb) is typically equivalent to ETH_HLEN, or 14 bytes.\nWhen pskb_may_pull(skb, len) is invoked, it validates only the specified len bytes starting directly from skb->data rather than incorporating the offset required to reach the network layer header, which is calculated as skb_network_offset(skb) + len.\nConsequently, this validation failure can leave crucial portions of the network layer headers—such as ARP headers, IPv6 Neighbor Discovery data, or IP/IPv6 MDB keys—stored within non-linear socket buffer fragments instead of ensuring they reside in the linear data buffer.\nWhen downstream processing routines attempt to parse or manipulate these network headers assuming they are fully linearized, the discrepancy leads to improper memory access patterns.\nAn attacker can exploit this condition by transmitting specially crafted packets that force the VXLAN driver to process non-linear payloads through the vulnerable validation checks.\nStep-by-step, the attack flow involves the adversary sending network traffic destined for or traversing a VXLAN interface, triggering the execution of vxlan_xmit(), arp_reduce(), or vxlan_mdb_entry_skb_get().\nThe kernel executes the flawed pskb_may_pull() check, incorrectly assumes the network headers are fully accessible within the linear portion of the skb, and proceeds to parse the headers while they partially reside in non-linear fragments.\nThis mismatch causes memory parsing errors, potentially resulting in kernel panics, denial of service, or unpredictable behavior within the networking stack."
}