CRITICAL Introduced in 3.10
vxlan RouteShortcircuit UAF
CVE-2026-80681
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
02KernelScan AI Analysis
Risk summary
A use-after-free in the VXLAN driver's transmit path allows a local attacker to trigger kernel memory corruption by sending traffic through a VXLAN interface with L3 switching enabled. The stale pointer dereference can lead to information disclosure, arbitrary write, or kernel crashes. Any local user with access to send through a configured VXLAN interface can trigger this without elevated privileges.
Vulnerability analysis
In the VXLAN transmit path, the code caches a pointer to the packet's Ethernet header before calling a routing shortcut function that may reallocate the underlying socket buffer. When reallocation occurs, the cached pointer becomes dangling, and the subsequent read of the destination MAC address accesses freed memory. The fix re-fetches the Ethernet header pointer after the routing function returns, ensuring it always references valid memory. This vulnerability is reachable by any local user who can send packets through a VXLAN interface with L3 switching enabled; the interface must first be configured by an administrator, but triggering the bug itself requires no special privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.10 | 5.10.265 | 6375093eb45c |
| 5.15 | 3.10 | 5.15.216 | 1b7f7b653e35 |
| 6.1 | 3.10 | 6.1.183 | bf045341dfb3 |
| 6.12 | 3.10 | 6.12.103 | 1511631b7cfc |
| 6.18 | 3.10 | 6.18.44 | 1235e017aa11 |
| 6.6 | 3.10 | 6.6.151 | 2355c8c26d2a |
| 7.1 | 3.10 | 7.1.8 | c9dceac9e1c7 |
| mainline | 3.10 | 7.2 | 1395a676ec15 |
| cip/4.19 | 3.10 | 4.19.325-cip136 | 45eff2b157b9 |
| cip/4.19-rt | 3.10 | 4.19.325-cip136-rt50 | 45eff2b157b9 |
| cip/4.4 | 3.10 | 4.4.302-cip115 | 38965c6c98cb |
| cip/4.4-rt | 3.10 | 4.4.302-cip115-rt63 | 38965c6c98cb |
| cip/5.10 | 3.10 | 5.10.268-cip77 | 6375093eb45c |
| cip/5.10-rt | 3.10 | 5.10.268-cip77-rt34 | 6375093eb45c |
| cip/6.1 | 3.10 | 6.1.187-cip60 | bf045341dfb3 |
| cip/6.1-rt | 3.10 | 6.1.189-cip61-rt32 | bf045341dfb3 |
| cip/6.12 | 3.10 | 6.12.104-cip30 | 1511631b7cfc |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |