In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup").
Reproducer:
# ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0
Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it.
[1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: <TASK> __vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-staticUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.1.140-154.222Upgrade python3-perf6.12Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade python3-perf-debuginfoUpgrade perf6.12Upgrade kernel-libbpf-develUpgrade kernel-headersUpgrade kernel6.12-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-libbpf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-modules-extraUpgrade kernel-develUpgrade kernel-toolsUpgrade perf6.12-debuginfoUpgrade kernel6.12Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.12.29-33.102Upgrade kernel-debuginfo | Sep 9, 2025 | May 20, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | May 28, 2025 | May 20, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2025 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade dtb-amdUpgrade dtb-caviumUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-socionextUpgrade cluster-md-kmp-rtUpgrade kernel-rt-extraUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-default-optionalUpgrade dtb-xilinxUpgrade kernel-rt_debugUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-docsUpgrade reiserfs-kmp-azureUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade kernel-rt-optionalUpgrade kernel-develUpgrade dtb-armUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade kernel-source-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-azureUpgrade kernel-default-base-rebuildUpgrade kernel-default-livepatch-develUpgrade dtb-allwinnerUpgrade dtb-rockchipUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-defaultUpgrade dtb-renesasUpgrade kernel-rt_debug-develUpgrade kernel-debug-develUpgrade kernel-default-baseUpgrade reiserfs-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-64kb-extraUpgrade kernel-default-extraUpgrade kernel-rtUpgrade gfs2-kmp-rtUpgrade kernel-debugUpgrade kernel-azure-optionalUpgrade kernel-source-azureUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-symsUpgrade kernel-64kb-optionalUpgrade dtb-marvellUpgrade dtb-apmUpgrade dtb-appleUpgrade kernel-64kb-develUpgrade dtb-mediatekUpgrade kernel-zfcpdumpUpgrade dtb-freescaleUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-macrosUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-default-develUpgrade gfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-default-livepatchUpgrade kernel-azure-vdsoUpgrade kernel-azure-extraUpgrade kernel-devel-azureUpgrade dtb-hisiliconUpgrade dtb-amazonUpgrade dtb-lgUpgrade kernel-azure-develUpgrade cluster-md-kmp-defaultUpgrade kernel-sourceUpgrade kernel-rt-develUpgrade dtb-exynosUpgrade dtb-alteraUpgrade dtb-broadcomUpgrade dtb-qcomUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-devel-rtUpgrade kernel-default-vdsoUpgrade kernel-syms-azureUpgrade kernel-64kbUpgrade dtb-amlogic | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-oracleUpgrade linux-image-gcp-64kUpgrade linux-image-fipsUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-oracle-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-nvidiaUpgrade linux-image-genericUpgrade linux-image-virtual-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-gke-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-64k-6.14Upgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-gkeopUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-gcp-fipsUpgrade linux-image-azure-6.14Upgrade linux-image-realtime-6.14Upgrade linux-image-oem-22.04Upgrade linux-image-6.14.0-1007-oemUpgrade linux-image-lowlatencyUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-lowlatency-6.8Upgrade linux-image-6.14.0-24-genericUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-6.14Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-gcpUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-aws-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.14.0-1009-awsUpgrade linux-image-fips-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-virtualUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-ibm-classicUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-kvmUpgrade linux-image-azure-6.8Upgrade linux-image-raspi-6.14Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-oem-22.04bUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-xilinx-6.8Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-oem-24.04Upgrade linux-image-gke-6.8Upgrade linux-image-virtual-6.14Upgrade linux-image-xilinxUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-generic-6.8Upgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-intel-iotgUpgrade linux-image-raspi-realtimeUpgrade linux-image-gcp-6.14Upgrade linux-image-gke-64k-6.8Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-aws-lts-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-gkeUpgrade linux-image-azure | Jun 26, 2025 | May 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 8, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub