Cloudanix VulnDB

CVE-2026-80681

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux networking code could let attackers crash or take control of systems that handle certain virtual network traffic.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Cached eth header pointer from eth_hdr(skb) becomes invalid after route_shortcircuit() calls pskb_may_pull() which may reallocate skb->head, leading to use-after-free when vxlan_xmit() dereferences eth->h_dest.

Why it matters to the business

Remote attackers could crash or compromise Linux systems using VXLAN networking, causing denial of service for virtual network traffic or potential full system takeover with high severity.

How an attack unfolds

Attacker sends network packets that reach vxlan_xmit(), triggering route_shortcircuit() which reallocates the skb buffer; the stale cached pointer is then dereferenced, resulting in use-after-free.

How to fix it

Update the Linux kernel to a version containing the fix that re-fetches eth = eth_hdr(skb) immediately after calling route_shortcircuit().

How to confirm the fix worked

Inspect kernel source for the post-route_shortcircuit() eth header re-fetch and confirm the change is present in deployed kernels via version checks or source review.

Typical attack path

  1. Craft and send packets that traverse the VXLAN transmit path
  2. Invoke route_shortcircuit() to trigger pskb_may_pull() and skb reallocation
  3. Trigger dereference of the now-invalid eth header pointer

How to detect it

Review system and kernel logs for VXLAN-related crashes or memory corruption warnings; correlate with unusual network traffic patterns on VXLAN interfaces.

What your security team should do

  • Prioritize kernel updates on all systems using VXLAN
  • Test patched kernels in staging before broad deployment
  • Monitor upstream kernel changelogs for related fixes

The record

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().

Affected packages

Ecosystem Package Introduced Fixed