CVE-2026-98568

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use one headroom snapshot for neighbour replies

vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then

samples it again to reserve headroom. A concurrent vxlan_changelink() can

update needed_headroom between the two reads, creating a TOCTOU race. The

second value can exceed the allocation and make the Ethernet header write out

of bounds.

The race is reproducible on the unpatched kernel. It occurred when

vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed

the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte

skbuff_small_head allocation.

Snapshot the headroom once and use that value for both allocation and

reservation.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References