CVE-2026-80681
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel's vxlan subsystem, after calling route_shortcircuit(), the Ethernet header pointer may point to freed memory because the function can reallocate the skb buffer. This leads to a use-after-free when reading the destination address.
Risk Assessment
Use-after-free can lead to system crashes, network malfunction, or potential remote code execution.
Recommendation
Apply a Linux kernel patch that refreshes the eth pointer with eth = eth_hdr(skb) after calling route_shortcircuit().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().