CVE-2026-68116 (GCVE-0-2026-68116)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-17 04:59
VLAI
Title
vxlan: mdb: Fix source list corruption on a failed replace
Summary
In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix source list corruption on a failed replace When replacing the source list of an MDB remote entry, all existing sources are first marked for deletion and vxlan_mdb_remote_srcs_add() is then called to add the new source list. Sources present in the new list have their deletion mark cleared, and any sources left marked afterwards are removed. If vxlan_mdb_remote_srcs_add() fails partway through, its error path deletes all entries on the remote's source list. That rollback is only correct for its other caller, vxlan_mdb_remote_add(), where the remote was just allocated and the list contains solely entries added during the call. On the replace path the list also holds pre-existing sources, so a failed replace tears them down together with their (S, G) forwarding entries instead of leaving the entry unchanged. This is reachable from an existing (*, G) remote. An EXCLUDE filter that loses sources starts forwarding traffic that should be blocked, while an INCLUDE filter that loses sources drops traffic that should be forwarded. Mark entries created during the current pass with a new VXLAN_SGRP_F_NEW flag. On failure, delete only those entries and clear the deletion mark on the pre-existing ones, so a failed replace leaves the source list untouched. Retain the flag until the whole operation succeeds and then clear it. Also stop vxlan_mdb_remote_src_add() from deleting a pre-existing entry it only looked up when adding that entry's forwarding entry fails.
Severity
7.9 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < 5bc8fc1d2ff802eec839e03adef5df597421898d (git)
Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < 2c54dff57606590fa4abec46bab6bea3133f1539 (git)
Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < 79370b573e92e8f190eb5f9a511fa5398340d8b2 (git)
Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < 54a3c27b357dfb34f327f89bfadeb998bef8051e (git)
Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < dcd9b465965422b9654f6026e8a2fa8984f74c3c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_mdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5bc8fc1d2ff802eec839e03adef5df597421898d",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            },
            {
              "lessThan": "2c54dff57606590fa4abec46bab6bea3133f1539",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            },
            {
              "lessThan": "79370b573e92e8f190eb5f9a511fa5398340d8b2",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            },
            {
              "lessThan": "54a3c27b357dfb34f327f89bfadeb998bef8051e",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            },
            {
              "lessThan": "dcd9b465965422b9654f6026e8a2fa8984f74c3c",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_mdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix source list corruption on a failed replace\n\nWhen replacing the source list of an MDB remote entry, all existing\nsources are first marked for deletion and vxlan_mdb_remote_srcs_add()\nis then called to add the new source list. Sources present in the new\nlist have their deletion mark cleared, and any sources left marked\nafterwards are removed.\n\nIf vxlan_mdb_remote_srcs_add() fails partway through, its error path\ndeletes all entries on the remote\u0027s source list. That rollback is only\ncorrect for its other caller, vxlan_mdb_remote_add(), where the remote\nwas just allocated and the list contains solely entries added during\nthe call. On the replace path the list also holds pre-existing sources,\nso a failed replace tears them down together with their (S, G)\nforwarding entries instead of leaving the entry unchanged.\n\nThis is reachable from an existing (*, G) remote. An EXCLUDE filter\nthat loses sources starts forwarding traffic that should be blocked,\nwhile an INCLUDE filter that loses sources drops traffic that should be\nforwarded.\n\nMark entries created during the current pass with a new\nVXLAN_SGRP_F_NEW flag. On failure, delete only those entries and clear\nthe deletion mark on the pre-existing ones, so a failed replace leaves\nthe source list untouched. Retain the flag until the whole operation\nsucceeds and then clear it. Also stop vxlan_mdb_remote_src_add() from\ndeleting a pre-existing entry it only looked up when adding that\nentry\u0027s forwarding entry fails."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable via the RTM_NEWMDB rtnetlink control path (ndo_mdb_add); multicast data-plane packets use vxlan_mdb_xmit and never hit the replace/rollback logic.\nAC:L - An attacker with CAP_NET_ADMIN can create an existing (*,G) remote, issue NLM_F_REPLACE with a new source list, and reliably force vxlan_mdb_remote_srcs_add() to fail mid-loop (e.g., ENOMEM via memory pressure) to trigger the bad rollback.\nPR:L - rtnetlink requires CAP_NET_ADMIN for RTM_NEWMDB; this capability is obtainable by unprivileged users inside user/network namespaces, not solely by init-namespace root.\nUI:N - Exploitation requires only crafted rtnetlink MDB messages from a process with network-admin capability; no victim user action is needed.\nS:C - A corrupted EXCLUDE source list forwards multicast that policy intended to block to VXLAN remote peers, crossing intended overlay segmentation boundaries beyond the misconfigured netdev\u0027s local authority.\nC:L - EXCLUDE filter corruption removes per-source block rules, causing multicast payloads from previously blocked sources to be encapsulated and delivered to unauthorized VXLAN remotes.\nI:L - Failed replace corrupts MDB source lists and (S,G) forwarding state, causing unauthorized multicast delivery (EXCLUDE) or dropping traffic that should be forwarded (INCLUDE).\nA:H - INCLUDE filter corruption can wipe all source entries on a (*,G) remote, causing vxlan_mdb_xmit to permanently drop all multicast for that group until MDB state is manually repaired."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:59:06.287Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5bc8fc1d2ff802eec839e03adef5df597421898d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c54dff57606590fa4abec46bab6bea3133f1539"
        },
        {
          "url": "https://git.kernel.org/stable/c/79370b573e92e8f190eb5f9a511fa5398340d8b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/54a3c27b357dfb34f327f89bfadeb998bef8051e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcd9b465965422b9654f6026e8a2fa8984f74c3c"
        }
      ],
      "title": "vxlan: mdb: Fix source list corruption on a failed replace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68116",
    "datePublished": "2026-08-10T11:58:34.612Z",
    "dateReserved": "2026-07-30T09:28:09.369Z",
    "dateUpdated": "2026-08-17T04:59:06.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68116",
      "date": "2026-08-20",
      "epss": "0.00121",
      "percentile": "0.02283"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68116\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:19:56.560\",\"lastModified\":\"2026-08-17T05:18:11.023\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nvxlan: mdb: Fix source list corruption on a failed replace\\n\\nWhen replacing the source list of an MDB remote entry, all existing\\nsources are first marked for deletion and vxlan_mdb_remote_srcs_add()\\nis then called to add the new source list. Sources present in the new\\nlist have their deletion mark cleared, and any sources left marked\\nafterwards are removed.\\n\\nIf vxlan_mdb_remote_srcs_add() fails partway through, its error path\\ndeletes all entries on the remote\u0027s source list. That rollback is only\\ncorrect for its other caller, vxlan_mdb_remote_add(), where the remote\\nwas just allocated and the list contains solely entries added during\\nthe call. On the replace path the list also holds pre-existing sources,\\nso a failed replace tears them down together with their (S, G)\\nforwarding entries instead of leaving the entry unchanged.\\n\\nThis is reachable from an existing (*, G) remote. An EXCLUDE filter\\nthat loses sources starts forwarding traffic that should be blocked,\\nwhile an INCLUDE filter that loses sources drops traffic that should be\\nforwarded.\\n\\nMark entries created during the current pass with a new\\nVXLAN_SGRP_F_NEW flag. On failure, delete only those entries and clear\\nthe deletion mark on the pre-existing ones, so a failed replace leaves\\nthe source list untouched. Retain the flag until the whole operation\\nsucceeds and then clear it. Also stop vxlan_mdb_remote_src_add() from\\ndeleting a pre-existing entry it only looked up when adding that\\nentry\u0027s forwarding entry fails.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/vxlan/vxlan_mdb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a3a48de5eade770e911d35291217bdd69ce04ef1\",\"lessThan\":\"5bc8fc1d2ff802eec839e03adef5df597421898d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3a48de5eade770e911d35291217bdd69ce04ef1\",\"lessThan\":\"2c54dff57606590fa4abec46bab6bea3133f1539\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3a48de5eade770e911d35291217bdd69ce04ef1\",\"lessThan\":\"79370b573e92e8f190eb5f9a511fa5398340d8b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3a48de5eade770e911d35291217bdd69ce04ef1\",\"lessThan\":\"54a3c27b357dfb34f327f89bfadeb998bef8051e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a3a48de5eade770e911d35291217bdd69ce04ef1\",\"lessThan\":\"dcd9b465965422b9654f6026e8a2fa8984f74c3c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/vxlan/vxlan_mdb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H\",\"baseScore\":7.9,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":5.3}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2c54dff57606590fa4abec46bab6bea3133f1539\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/54a3c27b357dfb34f327f89bfadeb998bef8051e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5bc8fc1d2ff802eec839e03adef5df597421898d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/79370b573e92e8f190eb5f9a511fa5398340d8b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dcd9b465965422b9654f6026e8a2fa8984f74c3c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:18:08+00:00",
      "cve": "CVE-2026-68116",
      "id": "CVE-2026-68116",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "182",
      "product_status:known_not_affected": "94",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vxlan: mdb: Fix source list corruption on a failed replace",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68116.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-08-13T16:24:17Z",
      "cve": "CVE-2026-68116",
      "id": "CVE-2026-68116",
      "initial_release_date": "2026-08-13T16:24:17Z",
      "product_status:known_affected": "129",
      "product_status:known_not_affected": "167",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68116",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68116.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.