Cloudanix VulnDB

CVE-2026-98568

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in Linux VXLAN networking code can let an attacker on the same machine corrupt memory and potentially take over the system.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

TOCTOU race in vxlan_na_create allows concurrent vxlan_changelink to change needed_headroom between two LL_RESERVED_SPACE reads, causing skb allocation sized for the first value to receive insufficient headroom and resulting in an out-of-bounds Ethernet header write.

Why it matters to the business

Kernel memory corruption on Linux systems using VXLAN can produce crashes, data corruption, or local privilege escalation, disrupting virtual networking and cloud workloads.

How an attack unfolds

An attacker with local access triggers VXLAN neighbor advertisement creation while simultaneously issuing a link change that alters headroom; the race produces an undersized skb and an out-of-bounds write that an exploit can weaponize for memory corruption.

How to fix it

Upgrade the Linux kernel to a version containing the single-headroom-snapshot fix for vxlan_na_create; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains the commit that snapshots LL_RESERVED_SPACE once; reproduce the original KASAN report under concurrent load to confirm absence of the four-byte overflow.

Typical attack path

  1. Obtain local execution on a Linux host with VXLAN interfaces
  2. Start a thread that repeatedly calls vxlan_na_create via neighbor events
  3. Concurrently invoke vxlan_changelink to update device headroom
  4. Trigger the window where the second headroom read exceeds the prior allocation
  5. Exploit the resulting out-of-bounds write for privilege escalation or denial of service

How to detect it

Search kernel logs and KASAN reports for skbuff_small_head allocation size mismatches or out-of-bounds writes originating from vxlan_na_create during concurrent vxlan_changelink activity.

What your security team should do

  • Apply the upstream vxlan fix immediately on all systems exposing VXLAN
  • Prioritize patching in environments with high EPSS or public exploit maturity once available
  • Monitor kernel changelogs for related vxlan and skbuff hardening
  • Restrict unprivileged users from modifying VXLAN link parameters until patched

The record

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan_changelink() can update needed_headroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds. The race is reproducible on the unpatched kernel. It occurred when vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuff_small_head allocation. Snapshot the headroom once and use that value for both allocation and reservation.

Affected packages

Ecosystem Package Introduced Fixed