FKIE_CVE-2026-93250

Vulnerability from fkie_nvd - Published: 2026-09-24 16:17 - Updated: 2026-09-24 16:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() vxlan_mdb_flush() iterates over the MDB entries using hlist_for_each_entry_safe(), which only tolerates the removal of the current entry. Contrary to the comment above the loop, the removal of an entry can trigger the removal of another entry. Flushing the remotes of a (*, G) entry also removes the (S, G) entries that were created for its source list, once they are left without remotes: vxlan_mdb_remotes_flush() -> vxlan_mdb_remote_del() -> vxlan_mdb_remote_srcs_del() -> vxlan_mdb_remote_src_del() -> vxlan_mdb_remote_src_fwd_del() -> __vxlan_mdb_del() -> vxlan_mdb_entry_put() Such an entry can be located after the (*, G) entry in the list, as vxlan_mdb_entry_get() returns an existing entry without moving it to the head of the list. This order is obtained by adding the (S, G) entry before the (*, G) entry, the latter with NLM_F_REPLACE, as the addition of the source otherwise fails with -EEXIST. The (S, G) entry is then the entry saved by hlist_for_each_entry_safe() and it is freed while the (*, G) entry is processed. The next iteration calls hlist_del() on it again, writing LIST_POISON1 to LIST_POISON2 [1]. Besides device deletion, the flush is also reachable from RTM_DELMDB with NLM_F_BULK. Fix by re-reading the next entry after the remotes were flushed. The current entry cannot be removed by this flush, as source lists can only be configured on (*, G) entries and the removed entries are (S, G) entries. It is therefore still linked and its next pointer reflects the removals. [1] BUG: KASAN: wild-memory-access in vxlan_mdb_entry_put.part.0+0x328/0x588 Write of size 8 at addr dead000000000122 by task ip/327 CPU: 3 UID: 1000 PID: 327 Comm: ip Not tainted 7.2.0-rc7 #2 PREEMPT Call trace: vxlan_mdb_entry_put.part.0+0x328/0x588 vxlan_mdb_flush+0x1d8/0x25c vxlan_mdb_fini+0x8c/0x100 vxlan_uninit+0x1c/0x7c unregister_netdevice_many_notify+0x954/0xd4c rtnl_dellink+0x210/0x530 rtnetlink_rcv_msg+0x434/0x4d0 netlink_rcv_skb+0xc4/0x204 rtnetlink_rcv+0x18/0x24 netlink_unicast+0x4b8/0x548 netlink_sendmsg+0x29c/0x560 ____sys_sendmsg+0x390/0x3ec ___sys_sendmsg+0x114/0x188 __sys_sendmsg+0xf0/0x178 __arm64_sys_sendmsg+0x48/0x60 invoke_syscall.constprop.0+0x58/0x180 el0_svc_common.constprop.0+0x74/0x140 do_el0_svc+0x30/0x40 el0_svc+0x38/0x98 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3e6b705bc162fc7257645725a7d2cf6c71250318
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c7dc26d06f90ca11bbd6114f6a62a67d038816c7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f26400b325bdc2868e40612c4804c82cf8ba6275
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f8a9b988e7a7bc674e74e8c901794d792c35689e
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_mdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f8a9b988e7a7bc674e74e8c901794d792c35689e",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            },
            {
              "lessThan": "c7dc26d06f90ca11bbd6114f6a62a67d038816c7",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            },
            {
              "lessThan": "3e6b705bc162fc7257645725a7d2cf6c71250318",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            },
            {
              "lessThan": "f26400b325bdc2868e40612c4804c82cf8ba6275",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            },
            {
              "lessThan": "bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366",
              "status": "affected",
              "version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_mdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix use-after-free in vxlan_mdb_flush()\n\nvxlan_mdb_flush() iterates over the MDB entries using\nhlist_for_each_entry_safe(), which only tolerates the removal of the\ncurrent entry. Contrary to the comment above the loop, the removal of an\nentry can trigger the removal of another entry.\n\nFlushing the remotes of a (*, G) entry also removes the (S, G) entries\nthat were created for its source list, once they are left without\nremotes:\n\nvxlan_mdb_remotes_flush()\n-\u003e vxlan_mdb_remote_del()\n   -\u003e vxlan_mdb_remote_srcs_del()\n      -\u003e vxlan_mdb_remote_src_del()\n         -\u003e vxlan_mdb_remote_src_fwd_del()\n            -\u003e __vxlan_mdb_del()\n               -\u003e vxlan_mdb_entry_put()\n\nSuch an entry can be located after the (*, G) entry in the list, as\nvxlan_mdb_entry_get() returns an existing entry without moving it to the\nhead of the list. This order is obtained by adding the (S, G) entry\nbefore the (*, G) entry, the latter with NLM_F_REPLACE, as the addition\nof the source otherwise fails with -EEXIST. The (S, G) entry is then the\nentry saved by hlist_for_each_entry_safe() and it is freed while the\n(*, G) entry is processed. The next iteration calls hlist_del() on it\nagain, writing LIST_POISON1 to LIST_POISON2 [1].\n\nBesides device deletion, the flush is also reachable from RTM_DELMDB\nwith NLM_F_BULK.\n\nFix by re-reading the next entry after the remotes were flushed. The\ncurrent entry cannot be removed by this flush, as source lists can only\nbe configured on (*, G) entries and the removed entries are (S, G)\nentries. It is therefore still linked and its next pointer reflects the\nremovals.\n\n[1]\nBUG: KASAN: wild-memory-access in vxlan_mdb_entry_put.part.0+0x328/0x588\nWrite of size 8 at addr dead000000000122 by task ip/327\n\nCPU: 3 UID: 1000 PID: 327 Comm: ip Not tainted 7.2.0-rc7 #2 PREEMPT\nCall trace:\n vxlan_mdb_entry_put.part.0+0x328/0x588\n vxlan_mdb_flush+0x1d8/0x25c\n vxlan_mdb_fini+0x8c/0x100\n vxlan_uninit+0x1c/0x7c\n unregister_netdevice_many_notify+0x954/0xd4c\n rtnl_dellink+0x210/0x530\n rtnetlink_rcv_msg+0x434/0x4d0\n netlink_rcv_skb+0xc4/0x204\n rtnetlink_rcv+0x18/0x24\n netlink_unicast+0x4b8/0x548\n netlink_sendmsg+0x29c/0x560\n ____sys_sendmsg+0x390/0x3ec\n ___sys_sendmsg+0x114/0x188\n __sys_sendmsg+0xf0/0x178\n __arm64_sys_sendmsg+0x48/0x60\n invoke_syscall.constprop.0+0x58/0x180\n el0_svc_common.constprop.0+0x74/0x140\n do_el0_svc+0x30/0x40\n el0_svc+0x38/0x98\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c"
    }
  ],
  "id": "CVE-2026-93250",
  "lastModified": "2026-09-24T16:17:21.187",
  "metrics": {},
  "published": "2026-09-24T16:17:21.187",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3e6b705bc162fc7257645725a7d2cf6c71250318"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c7dc26d06f90ca11bbd6114f6a62a67d038816c7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f26400b325bdc2868e40612c4804c82cf8ba6275"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f8a9b988e7a7bc674e74e8c901794d792c35689e"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.