In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup").
Reproducer:
# ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0
Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it.
[1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: <TASK> __vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel6.12-modules-extraUpgrade kernel6.12Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.12.29-33.102Upgrade kernel-libbpfUpgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perfUpgrade perfUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-livepatch-6.1.140-154.222Upgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-debuginfoUpgrade perf6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel-modules-extra-commonUpgrade python3-perf-debuginfoUpgrade python3-perf6.12Upgrade bpftoolUpgrade kernel-libbpf-staticUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfo | Sep 9, 2025 | May 20, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | May 28, 2025 | May 20, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2025 |
| Suse | — | Upgrade dtb-qcomUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade dtb-apmUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade dtb-exynosUpgrade kernel-rt-livepatch-develUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade dtb-marvellUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade dlm-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-64kbUpgrade dtb-alteraUpgrade kernel-64kb-optionalUpgrade kernel-default-vdsoUpgrade dtb-hisiliconUpgrade kernel-devel-rtUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-syms-rtUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade kernel-debugUpgrade kernel-azure-develUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade kernel-obs-qaUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade kernel-rt-develUpgrade dtb-lgUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade dtb-broadcomUpgrade dtb-freescaleUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-rt-extraUpgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-default-base-rebuildUpgrade kernel-rt-optionalUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-defaultUpgrade kernel-docsUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade dtb-amdUpgrade kernel-rt-vdsoUpgrade kernel-obs-buildUpgrade dtb-socionextUpgrade kernel-source-vanillaUpgrade dtb-caviumUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-rt_debugUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-rtUpgrade gfs2-kmp-azureUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-default-baseUpgrade dtb-sprdUpgrade dtb-renesasUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-armUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-develUpgrade kernel-default-optionalUpgrade dtb-allwinnerUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatch-develUpgrade dtb-rockchip | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-gkeop-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-virtual-6.8Upgrade linux-image-fipsUpgrade linux-image-gcp-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.14.0-24-genericUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-raspiUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gke-64kUpgrade linux-image-oem-22.04Upgrade linux-image-gcp-fipsUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-6.14Upgrade linux-image-lowlatencyUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-azure-6.14Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-genericUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-lowlatency-64kUpgrade linux-image-aws-fipsUpgrade linux-image-lowlatency-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-6.14Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-realtime-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-nvidiaUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-gkeopUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-lpaeUpgrade linux-image-6.14.0-1007-oemUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-generic-64k-6.14Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-oracle-6.8Upgrade linux-image-oem-24.04cUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-raspi-6.14Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.14.0-1009-awsUpgrade linux-image-raspi-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-xilinxUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-azureUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-64kUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-gkeUpgrade linux-image-realtimeUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-fips-6.8Upgrade linux-image-aws-64k-6.14Upgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gcp-6.14Upgrade linux-image-raspi-realtimeUpgrade linux-image-virtual-6.14Upgrade linux-image-intel-iotgUpgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-azure-fipsUpgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-24.04aUpgrade linux-image-generic-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-azure-fips-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-azure-6.8Upgrade linux-image-generic-64k-6.8 | Jun 26, 2025 | May 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 8, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub