In the Linux kernel, the following vulnerability has been resolved:
vxlan: re-fetch eth header after route_shortcircuit()
Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).
Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head.
In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest.
Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.18Upgrade perf6.18-debuginfoUpgrade kernel6.18-headersUpgrade perf6.12-debuginfoUpgrade kernel6.18-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-develUpgrade bpftool6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12Upgrade python3-perf6.18Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.12-headersUpgrade kernel-livepatch-6.18.44-99.149Upgrade bpftool6.18-debuginfoUpgrade kernel6.12-debuginfoUpgrade python3-perf6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.18-debuginfoUpgrade kernel6.18-develUpgrade microvm-kernel6.18Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.12-toolsUpgrade perf6.18Upgrade perf6.12Upgrade kernel-livepatch-6.12.103-127.188Upgrade kernel6.12-tools-debuginfoUpgrade kernel6.18-modules-extraUpgrade bpftool6.18Upgrade kernel6.18-tools-develUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-tools-develUpgrade python3-perf6.12-debuginfoUpgrade kernel6.18-tools | Sep 30, 2026 | Aug 28, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Aug 30, 2026 | Aug 30, 2026 |
| Redhat_linux | — | No solution exists | Sep 2, 2026 | Aug 28, 2026 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1111-ibmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1117-awsUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-5.15.0-1113-gkeUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-gkeopUpgrade linux-image-generic-lpaeUpgrade linux-image-oracleUpgrade linux-image-aws-lts-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-lowlatency-5.15Upgrade linux-image-generic-5.15Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-azure-fde-5.15Upgrade linux-image-gcp-5.15Upgrade linux-image-5.15.0-1109-intel-iot-realtimeUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1123-azure-fipsUpgrade linux-image-5.15.0-1116-realtimeUpgrade linux-image-ibm-5.15Upgrade linux-image-gke-5.15Upgrade linux-image-generic-64k-5.15Upgrade linux-image-5.15.0-198-generic-64kUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-fips-5.15Upgrade linux-image-aws-fipsUpgrade linux-image-aws-64k-5.15Upgrade linux-image-fipsUpgrade linux-image-genericUpgrade linux-image-awsUpgrade linux-image-5.15.0-1100-gkeopUpgrade linux-image-aws-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-5.15.0-1112-intel-iotgUpgrade linux-image-5.15.0-1080-xilinx-zynqmpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1109-kvmUpgrade linux-image-5.15.0-195-lowlatencyUpgrade linux-image-virtual-5.15Upgrade linux-image-5.15.0-1123-azureUpgrade linux-image-gcp-fipsUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-azureUpgrade linux-image-5.15.0-195-lowlatency-64kUpgrade linux-image-fips-5.15Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-5.15.0-1122-azure-fdeUpgrade linux-image-5.15.0-1118-gcp-fipsUpgrade linux-image-5.15.0-198-genericUpgrade linux-image-5.15.0-198-fipsUpgrade linux-image-5.15.0-1117-aws-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-gcpUpgrade linux-image-azure-fipsUpgrade linux-image-5.15.0-1114-oracleUpgrade linux-image-oem-20.04dUpgrade linux-image-aws-fips-5.15Upgrade linux-image-kvmUpgrade linux-image-5.15.0-198-generic-lpaeUpgrade linux-image-azure-cvmUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-gkeop-5.15Upgrade linux-image-gkeUpgrade linux-image-generic-64kUpgrade linux-image-realtimeUpgrade linux-image-oracle-5.15Upgrade linux-image-oem-20.04cUpgrade linux-image-intelUpgrade linux-image-azure-5.15Upgrade linux-image-realtime-5.15Upgrade linux-image-intel-iotgUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1117-aws-fipsUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-5.15.0-1118-gcpUpgrade linux-image-kvm-5.15 | Oct 6, 2026 | Oct 6, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 15, 2026 | Aug 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub