Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:53.473Z",
  "pubdate": "2026-08-28T08:16:53.473Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel within the vxlan_xmit function, specifically related to how it handles the Ethernet header during the packet transmission process.\nThe vulnerability is triggered when the route_shortcircuit function is invoked, causing a potential reallocation of the skb buffer.\nThis flaw can lead to memory corruption, kernel panics, or potential privilege escalation if an attacker can manipulate the reallocated memory contents.\nThe vulnerability resides in the interaction between vxlan_xmit and route_shortcircuit, where a pointer to the Ethernet header is cached before memory reallocation, resulting in a dangling pointer.\nExploitation requires an attacker to be able to influence network traffic processed by the VXLAN subsystem to trigger the conditional path within route_shortcircuit.\nThe impact is significant, as it pertains to memory safety within the kernel network stack, potentially allowing for arbitrary code execution or local denial of service.",
  "technicalDetails": "The root cause of the vulnerability lies in an improper pointer caching mechanism within the vxlan_xmit function in the Linux kernel's VXLAN implementation. Before invoking the route_shortcircuit() routine, the function captures a pointer to the Ethernet header using the eth_hdr(skb) macro. This cached pointer serves as a reference for subsequent operations on the packet.\nDuring the execution of route_shortcircuit(), the kernel may invoke pskb_may_pull(). This function ensures that the required amount of data is present in the skb's linear buffer. If the data is not present, pskb_may_pull() may trigger a reallocation of the skb->head if a pull operation is necessary to expand the linear area. This reallocation essentially frees the original buffer memory that the previously cached Ethernet header pointer is referencing.\nUpon returning to the execution flow of vxlan_xmit(), the function attempts to dereference the cached eth pointer (specifically eth->h_dest) under the assumption that the underlying memory is still valid. Because the memory has been reallocated, this operation constitutes a use-after-free vulnerability.\nThe attack flow follows a deterministic path: 1) A packet is processed by vxlan_xmit, where the eth header pointer is established; 2) The execution branches into route_shortcircuit(); 3) Internal logic within route_shortcircuit() invokes pskb_may_pull(), triggering a heap reallocation; 4) The original memory is freed; 5) Control returns to vxlan_xmit(), which proceeds to access the stale pointer address.\nThe impact of this vulnerability is severe. Since the kernel is dereferencing a pointer to freed memory, an attacker capable of triggering this code path can potentially manipulate the system memory allocator (SLUB/SLAB) to place controlled data in the memory location previously occupied by the skb head. This allows the attacker to influence the values read during the dereference, potentially leading to kernel information disclosure, denial of service through system instability, or, in complex scenarios, controlled arbitrary write primitives depending on how the data is subsequently utilized in the kernel's network processing pipeline.\nThe vulnerability is specifically constrained to the interaction between the VXLAN transmission logic and the routing stack, specifically when route_shortcircuit is utilized."
}