CVE-2026-68116: Linux Kernel Privilege Escalation Flaw

CVE-2026-68116 Overview

CVE-2026-68116 is a Linux kernel vulnerability in the VXLAN Multicast Database (MDB) subsystem. The flaw affects the source list replace path for MDB remote entries. When vxlan_mdb_remote_srcs_add() fails partway through a replace operation, the error path incorrectly deletes pre-existing sources along with their (S, G) forwarding entries. This corrupts multicast filtering state on live VXLAN tunnels.

The issue is reachable from an existing (*, G) remote entry. An EXCLUDE filter that loses sources begins forwarding traffic that should be blocked. An INCLUDE filter that loses sources drops traffic that should be forwarded. Both outcomes break the intended multicast security policy on the overlay network.

Critical Impact
A failed MDB source list replace corrupts VXLAN multicast filtering, causing traffic that should be blocked to be forwarded or vice versa, undermining network segmentation.

Affected Products

Linux kernel VXLAN driver (drivers/net/vxlan)
Distributions shipping vulnerable stable kernel branches prior to the referenced patch commits
Systems using VXLAN overlays with MDB source-specific multicast filtering

Discovery Timeline

2026-08-10 - CVE-2026-68116 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68116

Vulnerability Analysis

The vulnerability resides in the VXLAN MDB source list replace logic. When user space replaces the source list of an MDB remote entry, the kernel marks all existing sources for deletion, then calls vxlan_mdb_remote_srcs_add() to add the new sources. Sources that appear in the new list have their deletion mark cleared. Any sources still marked afterwards are removed.

The defect lies in the error path of vxlan_mdb_remote_srcs_add(). On partial failure, the function deletes every entry on the remote's source list. That behavior is correct only for the other caller, vxlan_mdb_remote_add(), where the remote was just allocated and no pre-existing sources exist. On the replace path, the source list also contains pre-existing entries. A failed replace therefore tears down live sources and their forwarding entries instead of preserving the previous state.

The operational impact depends on filter mode. On an EXCLUDE filter, dropping sources widens what traffic passes. On an INCLUDE filter, dropping sources narrows what traffic passes. Either way, the data plane no longer matches the intended policy.

Root Cause

The root cause is shared error-path logic between two callers with different invariants. The rollback assumes all entries on the source list were added during the current call, which holds only for vxlan_mdb_remote_add(). On the replace path, that assumption breaks and the rollback destroys pre-existing state.

Attack Vector

Exploitation requires local privileges sufficient to configure the VXLAN MDB, typically CAP_NET_ADMIN in the relevant network namespace. An actor triggering a failing replace on an existing (*, G) remote can force the kernel to tear down source-specific forwarding entries. This alters traffic forwarding decisions on the VXLAN overlay and can be used to bypass multicast filtering policy or disrupt tenant traffic.

The upstream fix introduces a VXLAN_SGRP_F_NEW flag to mark entries created during the current pass. On failure, only entries carrying the flag are deleted, and the deletion mark is cleared on pre-existing entries. The flag is cleared once the operation completes successfully. The fix also stops vxlan_mdb_remote_src_add() from deleting a pre-existing entry it only looked up when adding that entry's forwarding entry fails.

Detection Methods for CVE-2026-68116

Indicators of Compromise

Unexpected removal of (S, G) forwarding entries on VXLAN interfaces following MDB configuration changes
RTM_DELMDB netlink notifications for sources that were not explicitly deleted by administrators
Multicast traffic on VXLAN overlays no longer matching the intended INCLUDE or EXCLUDE filter policy

Detection Strategies

Audit kernel versions across Linux hosts and compare against the patched stable branches referenced in the kernel.org commits
Correlate MDB replace operations from iproute2 (bridge mdb replace) with subsequent unexpected RTM_DELMDB events
Monitor for user-space processes invoking VXLAN MDB netlink operations from non-administrative workloads

Monitoring Recommendations

Enable audit rules on netlink socket operations affecting bridge and VXLAN MDB configuration
Track CAP_NET_ADMIN usage in containerized workloads that should not require network reconfiguration privileges
Alert on drift between declared multicast filter policy and observed forwarding table state

How to Mitigate CVE-2026-68116

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 2c54dff5, 54a3c27b, 5bc8fc1d, 79370b57, and dcd9b465
Update to a distribution kernel that incorporates the fix for vxlan_mdb_remote_srcs_add() error handling
Restrict CAP_NET_ADMIN in the host network namespace to trusted administrators and workloads only

Patch Information

The fix is available in the stable kernel tree across multiple branches. See the Kernel Patch Update 1, Kernel Patch Update 2, Kernel Patch Update 3, Kernel Patch Update 4, and Kernel Patch Update 5. The patch introduces the VXLAN_SGRP_F_NEW flag to correctly distinguish newly added sources from pre-existing ones during rollback.

Workarounds

Avoid using MDB source list replace operations on VXLAN interfaces until patches are deployed; prefer explicit add and delete sequences that do not exercise the affected code path
Drop CAP_NET_ADMIN from container security profiles where it is not strictly required
Use seccomp or AppArmor profiles to restrict netlink RTM_NEWMDB operations from untrusted workloads

bash

# Drop CAP_NET_ADMIN in unprivileged containers
docker run --cap-drop=NET_ADMIN <image>

# Verify kernel version includes the fix
uname -r