In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup").
Reproducer:
# ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0
Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it.
[1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: <TASK> __vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade perf6.12Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-6.1.140-154.222Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel6.12-debuginfoUpgrade kernel-modules-extra-commonUpgrade python3-perf-debuginfoUpgrade python3-perf6.12Upgrade kernel-tools-debuginfoUpgrade python3-perf6.12-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-livepatch-6.12.29-33.102Upgrade kernel6.12-modules-extraUpgrade perf6.12-debuginfoUpgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpf-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade kernel-modules-extraUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel6.12 | Sep 9, 2025 | May 20, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | May 28, 2025 | May 20, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2025 |
| Suse | — | Upgrade dtb-armUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-extraUpgrade kernel-docsUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade dtb-sprdUpgrade kernel-debug-develUpgrade kselftests-kmp-azureUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-rt_debugUpgrade kernel-rt_debug-develUpgrade kernel-source-vanillaUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade dtb-allwinnerUpgrade kernel-default-livepatch-develUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-nvidiaUpgrade kernel-64kb-extraUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-defaultUpgrade kernel-source-rtUpgrade kernel-default-baseUpgrade kernel-defaultUpgrade kernel-rt-optionalUpgrade kernel-rt-vdsoUpgrade kernel-debug-vdsoUpgrade dtb-socionextUpgrade kernel-obs-buildUpgrade dtb-amdUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-default-optionalUpgrade kernel-develUpgrade dlm-kmp-rtUpgrade dtb-rockchipUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-zfcpdumpUpgrade ocfs2-kmp-64kbUpgrade kernel-macrosUpgrade kernel-64kb-optionalUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade dtb-freescaleUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-default-develUpgrade kernel-azure-vdsoUpgrade dtb-broadcomUpgrade kernel-default-livepatchUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-sourceUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-develUpgrade dtb-lgUpgrade dtb-exynosUpgrade dtb-alteraUpgrade kernel-azure-extraUpgrade dtb-qcomUpgrade kernel-obs-qaUpgrade cluster-md-kmp-azureUpgrade dtb-marvellUpgrade dtb-apmUpgrade kernel-source-azureUpgrade kernel-docs-htmlUpgrade kernel-symsUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kselftests-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade kernel-default-extraUpgrade kernel-debugUpgrade kernel-azure-optionalUpgrade kernel-64kbUpgrade dtb-amlogicUpgrade kernel-devel-rt | Dec 5, 2025 | Jul 8, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-aws-64kUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-awsUpgrade linux-image-nvidia-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-azure-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-64k-6.8Upgrade linux-image-6.14.0-1009-awsUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-kvmUpgrade linux-image-raspi-6.8Upgrade linux-image-raspi-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-xilinxUpgrade linux-image-raspi-realtimeUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-gcp-6.14Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-aws-fips-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-virtual-6.14Upgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-ibmUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-ibm-classicUpgrade linux-image-fips-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-virtualUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-oem-22.04cUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-azure-fipsUpgrade linux-image-azure-fips-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-gke-6.8Upgrade linux-image-generic-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-oem-6.14Upgrade linux-image-gkeopUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-fipsUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-oem-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-azure-6.14Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-generic-6.14Upgrade linux-image-nvidiaUpgrade linux-image-gcp-6.8Upgrade linux-image-gke-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-64k-6.14Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.14.0-24-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-genericUpgrade linux-image-realtime-6.14Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.14.0-1007-oemUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-nvidia-6.8 | Jun 26, 2025 | May 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 8, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub