In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup").
Reproducer:
# ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0
Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it.
[1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: <TASK> __vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernel-tools-debuginfoUpgrade perf6.12Upgrade kernelUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.1.140-154.222Upgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf6.12Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-libbpf-debuginfoUpgrade perf-debuginfoUpgrade kernel-libbpfUpgrade perfUpgrade kernel-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-modules-extraUpgrade perf6.12-debuginfoUpgrade kernel-toolsUpgrade kernel6.12Upgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-livepatch-6.12.29-33.102 | Sep 9, 2025 | May 20, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | May 28, 2025 | May 20, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2025 |
| Suse | — | Upgrade dtb-broadcomUpgrade kernel-rt-develUpgrade kernel-default-develUpgrade kernel-default-vdsoUpgrade kernel-zfcpdumpUpgrade dtb-amazonUpgrade kernel-devel-azureUpgrade kernel-64kb-optionalUpgrade dtb-alteraUpgrade dtb-amlogicUpgrade kernel-debugUpgrade dtb-hisiliconUpgrade kernel-sourceUpgrade kernel-obs-qaUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kbUpgrade kernel-rtUpgrade kernel-azure-optionalUpgrade dtb-appleUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade kernel-symsUpgrade kernel-devel-rtUpgrade kernel-syms-azureUpgrade kernel-source-azureUpgrade dtb-apmUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade kernel-azure-extraUpgrade kernel-azure-vdsoUpgrade kernel-docs-htmlUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade kernel-azure-develUpgrade dtb-freescaleUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade dtb-qcomUpgrade kernel-rt-livepatch-develUpgrade kernel-macrosUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-azureUpgrade kernel-kvmsmallUpgrade dlm-kmp-azureUpgrade dtb-socionextUpgrade kernel-kvmsmall-develUpgrade kernel-debug-develUpgrade dtb-renesasUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade dtb-sprdUpgrade reiserfs-kmp-64kbUpgrade dtb-caviumUpgrade kselftests-kmp-rtUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade gfs2-kmp-defaultUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade dtb-nvidiaUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-develUpgrade kernel-source-vanillaUpgrade gfs2-kmp-azureUpgrade kernel-default-optionalUpgrade kselftests-kmp-azureUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade kernel-docsUpgrade dtb-armUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kernel-obs-buildUpgrade dtb-amdUpgrade dlm-kmp-rt | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-gke-6.8Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-ibm-classicUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-aws-fips-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-64k-6.14Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-raspi-6.8Upgrade linux-image-6.14.0-1009-awsUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-xilinxUpgrade linux-image-azure-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-virtual-6.14Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-realtimeUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-virtualUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-gcpUpgrade linux-image-nvidia-64kUpgrade linux-image-aws-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04bUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-oem-24.04cUpgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-awsUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-oracle-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-oem-22.04Upgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-generic-6.14Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-realtime-6.8.1Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-generic-64k-6.14Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-fipsUpgrade linux-image-oem-22.04dUpgrade linux-image-gke-64kUpgrade linux-image-aws-fipsUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-6.14Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.14.0-24-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-6.8Upgrade linux-image-oracleUpgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1010-azureUpgrade linux-image-6.14.0-1007-oemUpgrade linux-image-realtime-6.14Upgrade linux-image-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-gcp-64k-lts-24.04 | Jun 26, 2025 | May 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 8, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub