CVE-2026-80681 Overview
CVE-2026-80681 is a use-after-free vulnerability in the Linux kernel's Virtual Extensible LAN (VXLAN) driver. The flaw resides in the vxlan_xmit() transmit path, where the Ethernet header pointer obtained through eth_hdr(skb) is cached before calling route_shortcircuit(). That function can invoke pskb_may_pull(), which may reallocate skb->head and invalidate the cached pointer. Dereferencing eth->h_dest after this reallocation results in access to freed memory. The issue has been resolved upstream by re-fetching the Ethernet header after route_shortcircuit() returns.
Critical Impact
A use-after-free in the VXLAN transmit path can cause kernel memory corruption, denial of service, or potential privilege escalation on systems using VXLAN tunneling.
Affected Products
- Linux kernel VXLAN driver (drivers/net/vxlan/)
- Distributions shipping affected stable kernel branches referenced in the upstream Git commits
- Systems configured with VXLAN overlay networking (common in container and cloud workloads)
Discovery Timeline
- 2026-08-28 - CVE-2026-80681 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80681
Vulnerability Analysis
The vulnerability affects VXLAN packet transmission in the Linux kernel networking stack. In vxlan_xmit(), the driver caches a pointer to the Ethernet header by calling eth_hdr(skb) on the outgoing socket buffer. This pointer references memory inside skb->head. The transmit path then calls route_shortcircuit(), which handles ARP and neighbor discovery short-circuit logic for VXLAN.
Inside route_shortcircuit(), the kernel may call pskb_may_pull() to ensure the linear portion of the skb contains enough data. When the current linear region is too small, pskb_may_pull() reallocates skb->head, freeing the previous allocation. Control then returns to vxlan_xmit() with the cached eth pointer still referencing the freed buffer.
The subsequent dereference of eth->h_dest reads from freed memory. The vulnerability is classified as a use-after-free condition in kernel space with network-reachable attack surface.
Root Cause
The root cause is a stale pointer bug. The vxlan_xmit() function does not refresh its cached eth_hdr(skb) pointer after calling a helper that can reallocate skb->head. Any function that internally calls pskb_may_pull(), skb_cow_head(), or similar skb-mutating helpers invalidates previously cached header pointers. The upstream fix re-assigns eth = eth_hdr(skb) immediately after the route_shortcircuit() call.
Attack Vector
Exploitation requires reaching the VXLAN transmit path with a crafted skb that triggers reallocation inside route_shortcircuit(). On hosts terminating VXLAN tunnels or bridging traffic into VXLAN interfaces, an attacker able to inject frames into the overlay may influence skb layout and force pskb_may_pull() to reallocate. The resulting dereference of freed memory can lead to kernel panic, information leakage, or memory corruption depending on allocator state.
No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-80681
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing vxlan_xmit, route_shortcircuit, or eth_hdr in dmesg and /var/log/kern.log
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads in the VXLAN driver on test or debug kernels
- Sudden VXLAN interface flaps, packet drops, or transmit stalls without configuration changes
Detection Strategies
- Inventory hosts running kernels predating the fix commits (1395a676ec15, 1511631b7cfc, 1b7f7b653e35, 2355c8c26d2a, 6375093eb45c, bf045341dfb3, c9dceac9e1c7, 1235e017aa11) against distribution advisories
- Correlate host crash dumps and kdump captures with VXLAN-related call stacks to identify triggered instances
- Monitor container and Kubernetes host telemetry for kernel instability on nodes using VXLAN-based CNI plugins (Flannel, Calico VXLAN mode, Cilium VXLAN)
Monitoring Recommendations
- Enable persistent kernel log collection and forward dmesg output to a centralized logging platform for anomaly review
- Track VXLAN interface counters (ip -s link show) and alert on abnormal tx_errors or tx_dropped spikes
- Establish baselines for kernel crash frequency on hypervisors and container hosts and alert on deviation
How to Mitigate CVE-2026-80681
Immediate Actions Required
- Identify all Linux hosts using VXLAN, including container platforms, hypervisors, and overlay network gateways
- Apply vendor kernel updates that incorporate the upstream fix re-fetching eth_hdr(skb) after route_shortcircuit()
- Prioritize patching on multi-tenant hosts and any system where untrusted workloads can send traffic through VXLAN interfaces
Patch Information
The fix is committed to the upstream Linux stable tree across multiple branches. Refer to the following upstream commits for the corrective change that re-fetches the Ethernet header after route_shortcircuit(): Kernel Git Commit 1395a676, Kernel Git Commit 1511631b, Kernel Git Commit 1b7f7b65, Kernel Git Commit 2355c8c2, Kernel Git Commit 6375093e, Kernel Git Commit bf045341, Kernel Git Commit c9dceac9, and Kernel Git Commit 1235e017. Consume the fix through your distribution's patched kernel package.
Workarounds
- Where VXLAN is not required, unload the vxlan kernel module (modprobe -r vxlan) and blacklist it to remove the vulnerable code path
- Restrict which network namespaces and tenants can create or send traffic through VXLAN interfaces using CAP_NET_ADMIN boundaries
- Segment overlay networks so untrusted workloads cannot inject frames that reach VXLAN transmit paths on shared hosts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.