CRITICAL Introduced in 3.8
vxlan RouteShortcircuit OOB
CVE-2026-74473
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskb_network_may_pull() in route_shortcircuit() route_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr)) (or ipv6hdr), which checks if bytes are available starting from skb->data. However, in vxlan_xmit(), skb->data points to the MAC header, so skb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20) only checks 20 bytes from skb->data (which is 14 bytes MAC header + 6 bytes of IP header), leaving the rest of the IP header potentially un-pulled in non-linear frags. Subsequent dereferences of ip_hdr(skb)->daddr can read beyond the pulled linear buffer length. Fix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to the length check to ensure the full network header is present in the linear buffer.
02KernelScan AI Analysis
Risk summary
A network attacker who can send traffic through a VXLAN device configured with route short-circuiting (DOVE) can trigger an out-of-bounds read of the IP destination address from non-linear socket buffer fragments. The read is bounded in size but can access stale or incorrect memory, leading to potential information disclosure, misrouted packets, or a kernel panic. Systems without VXLAN RSC enabled are not affected.
Vulnerability analysis
The VXLAN driver's route short-circuit feature validates that enough bytes are available in a packet's linear buffer before reading the IP destination address, but the check starts from the MAC header position rather than the network header position. Because of this offset, only a partial IP header is guaranteed to be linear; when the remainder sits in non-linear fragments, reading the destination address field accesses memory beyond the validated region. The fix switches to a validation helper that accounts for the network header offset, ensuring the full IP or IPv6 header is present in the linear buffer before any field is dereferenced. The vulnerable path is reached when a VXLAN device is configured with route short-circuiting enabled and processes transit packets; an attacker on any network that can route traffic through such a device can trigger the condition by sending packets whose internal layout becomes non-linear during kernel processing.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 3.8 | 5.15.216 | 6bd0a3a1b574 |
| 6.1 | 3.8 | 6.1.183 | 214ba43faf10 |
| 6.6 | 3.8 | 6.6.151 | 42887be7c4cf |
| 6.12 | 3.8 | 6.12.103 | aa0d31376d57 |
| 7.1 | 3.8 | 7.1.8 | 4f3f96e771a2 |
| mainline | 3.8 | 7.2 | 26bb2dd0a883 |
| 5.10 | 3.8 | 5.10.265 | c419af4924c1 |
| 6.18 | 3.8 | 6.18.44 | ee799977d794 |