CVE-2026-98122

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()

vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every

MDBE_ATTR_SRC_LIST member, accepts the all-zeros address.

A source list is only accepted on a (*, G) entry, whose source is the

all-zeros address, and for each member of the list an (S, G) entry is

derived from it by substituting the source. Entries are keyed by a plain

memcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present

and holds the all-zeros address and the source list holds it as well, the

derived (S, G) key is byte-identical to the (*, G) key and resolves to the

same entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is

then left with a zero address family.

vxlan_mdb_remote_src_del() removes the forwarding entry of a source before

freeing the source entry:

vxlan_mdb_remote_src_fwd_del(vxlan, group, remote, &ent->addr);

vxlan_mdb_remote_src_ent

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References