In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup").
Reproducer:
# ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0
Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it.
[1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: <TASK> __vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-modules-extraUpgrade kernel-libbpf-debuginfoUpgrade kernel-tools-develUpgrade perf6.12-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-headersUpgrade python3-perfUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-livepatch-6.12.29-33.102Upgrade kernel-modules-extraUpgrade kernel6.12Upgrade kernel-debuginfoUpgrade kernel-toolsUpgrade perfUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-debuginfoUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-libbpf-staticUpgrade kernelUpgrade python3-perf6.12Upgrade python3-perf-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.140-154.222Upgrade perf6.12Upgrade python3-perf6.12-debuginfo | Sep 9, 2025 | May 20, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | May 28, 2025 | May 20, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2025 |
| Suse | — | Upgrade kernel-default-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-rt-optionalUpgrade kselftests-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-default-baseUpgrade dlm-kmp-defaultUpgrade kernel-develUpgrade dtb-sprdUpgrade kernel-debug-develUpgrade dtb-renesasUpgrade kernel-default-optionalUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-rockchipUpgrade kernel-source-rtUpgrade kselftests-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade dtb-caviumUpgrade kernel-64kb-extraUpgrade kernel-azureUpgrade dtb-nvidiaUpgrade gfs2-kmp-azureUpgrade dtb-allwinnerUpgrade gfs2-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kernel-rt_debug-develUpgrade kernel-source-vanillaUpgrade kernel-docsUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-armUpgrade dlm-kmp-rtUpgrade dtb-amdUpgrade dtb-socionextUpgrade dtb-apmUpgrade kernel-source-azureUpgrade kernel-docs-htmlUpgrade dtb-broadcomUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade dtb-amazonUpgrade dtb-hisiliconUpgrade kernel-64kb-optionalUpgrade kernel-64kb-develUpgrade dtb-appleUpgrade cluster-md-kmp-azureUpgrade kernel-symsUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade kernel-default-extraUpgrade kernel-debugUpgrade kernel-azure-optionalUpgrade kernel-64kbUpgrade dtb-amlogicUpgrade kernel-default-vdsoUpgrade kernel-devel-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-develUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade dtb-freescaleUpgrade kernel-rt-livepatch-develUpgrade kernel-sourceUpgrade dtb-exynosUpgrade kernel-rt-develUpgrade dtb-qcomUpgrade dtb-lgUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-macrosUpgrade kselftests-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-obs-qaUpgrade kernel-azure-vdsoUpgrade kernel-azure-extra | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-22.04cUpgrade linux-image-oem-24.04cUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-xilinxUpgrade linux-image-virtual-6.14Upgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-nvidia-64kUpgrade linux-image-aws-6.14Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-intel-iotgUpgrade linux-image-raspi-6.14Upgrade linux-image-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-aws-fips-6.8Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-xilinx-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-fipsUpgrade linux-image-oem-22.04bUpgrade linux-image-gkeUpgrade linux-image-ibm-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-azure-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-ibm-classicUpgrade linux-image-fips-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-ibmUpgrade linux-image-aws-64k-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-6.14Upgrade linux-image-raspi-6.8Upgrade linux-image-6.14.0-1009-awsUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-oracle-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-generic-6.14Upgrade linux-image-raspiUpgrade linux-image-lowlatency-64kUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-nvidiaUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gke-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-fipsUpgrade linux-image-6.14.0-24-genericUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-oracle-6.14Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-genericUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-generic-lpaeUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04aUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-aws-fipsUpgrade linux-image-realtime-6.8.1Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-oracleUpgrade linux-image-generic-64k-6.14Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.14.0-1007-oemUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-virtual-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-azure-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-lowlatency-hwe-22.04 | Jun 26, 2025 | May 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 8, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub