Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neigh_ha_snapshot() in route_shortcircuit() The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address. Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it. Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-15T13:17:52.293Z",
  "pubdate": "2026-08-15T13:17:52.293Z",
  "executiveSummary": "A race condition vulnerability exists within the Linux kernel VXLAN subsystem, specifically in the route_shortcircuit() function, involving the asynchronous updates of neighbour hardware addresses. The vulnerability is classified as a concurrency issue leading to torn reads or reading partially updated MAC addresses due to the absence of proper locking mechanisms during memory access. The affected component is the Linux kernel VXLAN network driver implementation handling route short-circuiting. The risk implication centers on data corruption, memory state inconsistency, and potential misdirection of network traffic within virtualized network segments. Exploitation of this vulnerability requires local execution context or network packet processing interactions that trigger the asynchronous neighbor hardware address updates while route short-circuiting is actively evaluating the destination MAC address. No specific CVE identifier or version number is provided in the context, but the defect allows for unsynchronized access to the n->ha structure protected by the n->ha_lock seqlock.",
  "technicalDetails": "The root cause of the vulnerability lies in the unsynchronized read operation of the neighbour hardware address n->ha within the route_shortcircuit() function of the VXLAN subsystem. The neighbour subsystem updates n->ha asynchronously, protecting these modifications with the n->ha_lock seqlock. Previously, route_shortcircuit() read n->ha directly without invoking the necessary sequence lock validation loop, resulting in a classic race condition known as a torn read.\nWhen a torn read occurs, the system reads a partially updated MAC address because the read operation overlaps with a write operation by the neighbour subsystem. This leads to memory inconsistency where the destination hardware address used for packet encapsulation or forwarding is malformed or represents a spliced state of two different addresses.\nThe attack flow proceeds when the VXLAN driver processes packets via route_shortcircuit(). If an asynchronous update to the neighbor entry occurs concurrently, the unprotected memory read fetches invalid hardware address bytes. Consequently, network frames can be misdirected to unintended MAC addresses on the local segment, causing packet loss, intermittent connectivity failures, or potential traffic interception within localized network boundaries depending on the exact corruption pattern.\nThe vulnerable component is the route_shortcircuit() function within the VXLAN module of the Linux kernel. The exploitation mechanism relies on timing windows during concurrent neighbour table updates and packet processing paths. Authentication and privilege requirements are dependent on kernel-level execution or network conditions that stimulate neighbor discovery and route short-circuiting logic. The fix requires utilizing the neigh_ha_snapshot() function to safely copy n->ha under proper read_seqbegin() and read_seqretry() lock protection."
}