Cloudanix VulnDB

CVE-2026-68116

High · 7.9

CVSS

7.9

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux network code can corrupt multicast forwarding rules in virtual networks, potentially letting the wrong traffic through or blocking legitimate traffic until the system is updated.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper rollback during partial failure of vxlan_mdb_remote_srcs_add on an MDB replace path deletes pre-existing sources and (S,G) forwarding entries instead of leaving the remote entry unchanged, allowing an EXCLUDE filter to forward blocked traffic or an INCLUDE filter to drop allowed traffic.

Why it matters to the business

Disrupted multicast forwarding in VXLAN-based virtual networks can cause traffic leakage or loss, affecting availability and isolation of container or VM workloads that rely on correct source filtering.

How an attack unfolds

An attacker with local access crafts a failing replace operation against an existing (*,G) remote MDB entry; the error path tears down both newly added and pre-existing sources, resulting in incorrect forwarding state that an attacker can observe or abuse.

How to fix it

Apply the upstream kernel commit that introduces the VXLAN_SGRP_F_NEW flag and adjusts the error path to delete only entries created in the current pass; rebuild and deploy the fixed kernel on all affected hosts.

How to confirm the fix worked

Confirm the presence of the VXLAN_SGRP_F_NEW flag handling in vxlan_mdb.c and test replace operations that deliberately fail midway to ensure pre-existing sources remain intact.

Typical attack path

  1. Obtain local unprivileged access on a system using VXLAN with MDB remote entries
  2. Trigger a source-list replace for an (*,G) entry that causes vxlan_mdb_remote_srcs_add to fail partway
  3. Observe resulting forwarding of traffic that should be excluded or dropping of traffic that should be included
  4. Leverage the incorrect forwarding for traffic analysis, exfiltration, or denial of service

How to detect it

Review kernel logs for vxlan_mdb warnings or errors during MDB replace operations; inspect forwarding tables before and after source-list changes for unexpected source loss.

What your security team should do

  • Prioritize kernel updates on all hosts running VXLAN with MDB filtering
  • Audit VXLAN multicast configurations for use of source lists
  • Monitor kernel mailing lists for related vxlan_mdb fixes
  • Test failover and replace operations in staging before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix source list corruption on a failed replace When replacing the source list of an MDB remote entry, all existing sources are first marked for deletion and vxlan_mdb_remote_srcs_add() is then called to add the new source list. Sources present in the new list have their deletion mark cleared, and any sources left marked afterwards are removed. If vxlan_mdb_remote_srcs_add() fails partway through, its error path deletes all entries on the remote's source list. That rollback is only correct for its other caller, vxlan_mdb_remote_add(), where the remote was just allocated and the list contains solely entries added during the call. On the replace path the list also holds pre-existing sources, so a failed replace tears them down together with their (S, G) forwarding entries instead of leaving the entry unchanged. This is reachable from an existing (*, G) remote. An EXCLUDE filter that loses sources starts forwarding traffic that should be blocked, while an INCLUDE filter that loses sources drops traffic that should be forwarded. Mark entries created during the current pass with a new VXLAN_SGRP_F_NEW flag. On failure, delete only those entries and clear the deletion mark on the pre-existing ones, so a failed replace leaves the source list untouched. Retain the flag until the whole operation succeeds and then clear it. Also stop vxlan_mdb_remote_src_add() from deleting a pre-existing entry it only looked up when adding that entry's forwarding entry fails.

Affected packages

Ecosystem Package Introduced Fixed