CVE-2026-80681 (GCVE-0-2026-80681)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:52 – Updated: 2026-08-29 06:22
VLAI
Title
vxlan: re-fetch eth header after route_shortcircuit()
Summary
In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ae8840825605f36f98f247323edc150e761cb64e , < 6375093eb45cd7d89f1945f939eeae3b29d79f56 (git)
Affected: ae8840825605f36f98f247323edc150e761cb64e , < 1b7f7b653e3557690047c62f03b80a24ea5a58a5 (git)
Affected: ae8840825605f36f98f247323edc150e761cb64e , < bf045341dfb3e767f0ff94cf240ce3c371973bd4 (git)
Affected: ae8840825605f36f98f247323edc150e761cb64e , < 2355c8c26d2aa1b4385b369e67202e47d460d555 (git)
Affected: ae8840825605f36f98f247323edc150e761cb64e , < 1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585 (git)
Affected: ae8840825605f36f98f247323edc150e761cb64e , < 1235e017aa11cf01e91b613c4c5ed6aa28934fff (git)
Affected: ae8840825605f36f98f247323edc150e761cb64e , < c9dceac9e1c7c772c43c732fc0d325e72835801a (git)
Affected: ae8840825605f36f98f247323edc150e761cb64e , < 1395a676ec15a0a02a2a6d86602324f2d5fd41d5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6375093eb45cd7d89f1945f939eeae3b29d79f56",
              "status": "affected",
              "version": "ae8840825605f36f98f247323edc150e761cb64e",
              "versionType": "git"
            },
            {
              "lessThan": "1b7f7b653e3557690047c62f03b80a24ea5a58a5",
              "status": "affected",
              "version": "ae8840825605f36f98f247323edc150e761cb64e",
              "versionType": "git"
            },
            {
              "lessThan": "bf045341dfb3e767f0ff94cf240ce3c371973bd4",
              "status": "affected",
              "version": "ae8840825605f36f98f247323edc150e761cb64e",
              "versionType": "git"
            },
            {
              "lessThan": "2355c8c26d2aa1b4385b369e67202e47d460d555",
              "status": "affected",
              "version": "ae8840825605f36f98f247323edc150e761cb64e",
              "versionType": "git"
            },
            {
              "lessThan": "1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585",
              "status": "affected",
              "version": "ae8840825605f36f98f247323edc150e761cb64e",
              "versionType": "git"
            },
            {
              "lessThan": "1235e017aa11cf01e91b613c4c5ed6aa28934fff",
              "status": "affected",
              "version": "ae8840825605f36f98f247323edc150e761cb64e",
              "versionType": "git"
            },
            {
              "lessThan": "c9dceac9e1c7c772c43c732fc0d325e72835801a",
              "status": "affected",
              "version": "ae8840825605f36f98f247323edc150e761cb64e",
              "versionType": "git"
            },
            {
              "lessThan": "1395a676ec15a0a02a2a6d86602324f2d5fd41d5",
              "status": "affected",
              "version": "ae8840825605f36f98f247323edc150e761cb64e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: re-fetch eth header after route_shortcircuit()\n\nBefore route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).\n\nInside route_shortcircuit(), pskb_may_pull() can be called, which may\nreallocate skb-\u003ehead.\n\nIn this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to\nfreed memory, leading to a use-after-free when dereferencing eth-\u003eh_dest.\n\nFix this by updating eth = eth_hdr(skb) after calling route_shortcircuit()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in vxlan_xmit(), reached when the kernel transmits packets out a VXLAN netdev via routing, bridging, or overlay forwarding; remote peers can inject IPv4/IPv6 Ethernet frames that traverse this TX path on cloud, Kubernetes, and data-center VXLAN deployments.\nAC:L - An attacker controlling overlay or forwarded traffic can reliably meet RSC prerequisites (router FDB entry, IPv4/IPv6 ethertype, neighbour MAC mismatch, cloned/nonlinear skb) so route_shortcircuit() calls pskb_may_pull/skb_cow_head and reallocates skb-\u003ehead, invalidating the cached eth pointer.\nPR:N - Exploitation requires only sending network traffic processed by an existing VXLAN interface with RSC enabled, not host administrator credentials; remote overlay peers and unauthenticated senders whose packets are forwarded through VXLAN need no elevated privileges on the target.\nUI:N - The use-after-free is triggered automatically during kernel packet transmit processing in vxlan_xmit() with no action required from a local user or administrator beyond normal network operation on a VXLAN-enabled host.\nS:U - The stale eth_hdr pointer causes heap use-after-free within the kernel\u0027s own memory domain during VXLAN transmit processing; impact is standard in-kernel memory corruption and does not inherently cross VM, container, or IOMMU security boundaries.\nC:H - After route_shortcircuit() reallocates skb-\u003ehead, vxlan_xmit() dereferences the stale eth pointer for eth-\u003eh_dest, constituting a heap use-after-free read that can disclose adjacent freed slab contents and support further kernel memory disclosure primitives.\nI:H - Use-after-free of the Ethernet header buffer in skb head memory enables attacker-controlled reuse of freed kmalloc slabs, a well-established path to heap grooming and arbitrary kernel memory corruption or control-flow hijacking beyond the immediate MAC header read.\nA:H - Dereferencing a freed skb head pointer in vxlan_xmit() can cause an immediate kernel oops or panic from invalid memory access, and UAF heap corruption routinely destabilizes or crashes the system even when full exploitation is not pursued."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:07.840Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555"
        },
        {
          "url": "https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585"
        },
        {
          "url": "https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5"
        }
      ],
      "title": "vxlan: re-fetch eth header after route_shortcircuit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80681",
    "datePublished": "2026-08-28T06:52:48.896Z",
    "dateReserved": "2026-08-26T14:34:25.783Z",
    "dateUpdated": "2026-08-29T06:22:07.840Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80681",
      "date": "2026-09-21",
      "epss": "0.00506",
      "percentile": "0.42082"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:55:57.000Z",
      "cve": "CVE-2026-80681",
      "id": "msrc_CVE-2026-80681",
      "initial_release_date": "2026-08-29T01:05:11.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "vxlan: re-fetch eth header after route_shortcircuit()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80681.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/vxlan/vxlan_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6375093eb45cd7d89f1945f939eeae3b29d79f56",
                    "status": "affected",
                    "version": "ae8840825605f36f98f247323edc150e761cb64e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b7f7b653e3557690047c62f03b80a24ea5a58a5",
                    "status": "affected",
                    "version": "ae8840825605f36f98f247323edc150e761cb64e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf045341dfb3e767f0ff94cf240ce3c371973bd4",
                    "status": "affected",
                    "version": "ae8840825605f36f98f247323edc150e761cb64e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2355c8c26d2aa1b4385b369e67202e47d460d555",
                    "status": "affected",
                    "version": "ae8840825605f36f98f247323edc150e761cb64e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585",
                    "status": "affected",
                    "version": "ae8840825605f36f98f247323edc150e761cb64e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1235e017aa11cf01e91b613c4c5ed6aa28934fff",
                    "status": "affected",
                    "version": "ae8840825605f36f98f247323edc150e761cb64e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c9dceac9e1c7c772c43c732fc0d325e72835801a",
                    "status": "affected",
                    "version": "ae8840825605f36f98f247323edc150e761cb64e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1395a676ec15a0a02a2a6d86602324f2d5fd41d5",
                    "status": "affected",
                    "version": "ae8840825605f36f98f247323edc150e761cb64e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/vxlan/vxlan_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.10"
                  },
                  {
                    "lessThan": "3.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: re-fetch eth header after route_shortcircuit()\n\nBefore route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).\n\nInside route_shortcircuit(), pskb_may_pull() can be called, which may\nreallocate skb-\u003ehead.\n\nIn this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to\nfreed memory, leading to a use-after-free when dereferencing eth-\u003eh_dest.\n\nFix this by updating eth = eth_hdr(skb) after calling route_shortcircuit()."
          }
        ],
        "id": "CVE-2026-80681",
        "lastModified": "2026-08-29T07:16:50.530",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-28T08:16:53.473",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T14:30:57+00:00",
      "cve": "CVE-2026-80681",
      "id": "CVE-2026-80681",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vxlan: re-fetch eth header after route_shortcircuit()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80681.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:09:53Z",
      "cve": "CVE-2026-80681",
      "id": "CVE-2026-80681",
      "initial_release_date": "2026-08-28T16:34:18Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80681",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80681.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.