CVE-2026-80838: Linux Kernel VXLAN Use-After-Free Vulnerability

CVE-2026-80838 Overview

CVE-2026-80838 is a use-after-free vulnerability in the Linux kernel's Virtual Extensible LAN (VXLAN) forwarding database (FDB) implementation. The flaw occurs during a filtered bulk FDB flush when every remote of a non-nexthop entry matches the filter. The kernel unlinks the last remote in vxlan_fdb_dst_destroy() before removing the parent FDB entry, leaving a window in which the entry remains reachable through the FDB hash table with an empty remote list. A concurrent Read-Copy-Update (RCU) reader traversing first_remote_rcu() can then dereference an invalid pointer produced by list_entry_rcu() on an empty list head.

Critical Impact
A race condition in the VXLAN FDB flush path allows an RCU reader on the receive learning path to read from and write to an invalid remote pointer, leading to kernel memory corruption.

Affected Products

Linux kernel (VXLAN driver, drivers/net/vxlan/)
Distributions shipping kernels prior to the fixes in commits 2a7c2f0, 4bbc76e, 8ba68fd, a8820c8, and d5d4a7b
Systems using VXLAN tunneling with non-nexthop FDB entries

Discovery Timeline

2026-09-04 - CVE-2026-80838 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80838

Vulnerability Analysis

The VXLAN driver maintains FDB entries that map inner MAC addresses to one or more remote VXLAN tunnel endpoints. A non-nexthop FDB entry is expected to keep at least one remote attached while the entry remains reachable through the FDB hash table. This invariant is what allows RCU readers on the receive learning path to safely dereference the first remote via first_remote_rcu().

A filtered bulk flush breaks this invariant. When the flush criteria match every remote on an entry, vxlan_fdb_dst_destroy() unlinks the last remote before signaling vxlan_flush() to destroy the parent entry. Between those two steps, the parent entry is still linked in the hash table but its remote list is empty.

An RCU reader that finds the entry during this interval calls list_entry_rcu() against the empty list head, producing an invalid pointer treated as a struct vxlan_rdst. The receive learning path both reads from and writes to this pointer, resulting in out-of-bounds memory access.

Root Cause

The root cause is an ordering defect in the filtered FDB flush logic. Removal of the final remote must not precede removal of the parent FDB entry from lookup structures. The fix keeps the last matching remote linked and instructs the caller to destroy the entire FDB entry through vxlan_fdb_destroy(), which preserves the remote until after the deletion notification is sent and the parent is unlinked.

Attack Vector

Exploitation requires the ability to trigger a filtered bulk FDB flush concurrent with VXLAN receive traffic that drives the learning path. On a system where an attacker can influence VXLAN configuration or send crafted encapsulated frames, the race window enables kernel memory corruption. The vulnerability is local to the kernel network stack and does not require authenticated network access to the FDB management interface if VXLAN traffic can be induced from a peer.

See the upstream patch series for the exact code changes: Linux Kernel Commit 2a7c2f0 and Linux Kernel Commit d5d4a7b.

Detection Methods for CVE-2026-80838

Indicators of Compromise

Kernel oops or panic messages referencing vxlan_rdst, first_remote_rcu, or vxlan_snoop in system logs
KASAN reports flagging use-after-free or slab-out-of-bounds access in drivers/net/vxlan/
Unexpected VXLAN interface flaps or receive-path crashes on hosts performing bulk FDB flushes

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface the invalid dereference during VXLAN flush operations
Audit bridge fdb and netlink flush operations for filtered bulk deletes issued against VXLAN interfaces
Correlate kernel crash telemetry with VXLAN traffic patterns to identify hosts hitting the race window

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging pipeline for correlation with VXLAN control-plane events
Track kernel.printk warnings and RCU stall messages on hosts running VXLAN overlays
Alert on repeated VXLAN driver faults across a fleet, which may indicate active triggering of the race

How to Mitigate CVE-2026-80838

Immediate Actions Required

Identify kernel versions in use across the fleet and map them against the fixed stable branches referenced by the upstream commits
Apply vendor kernel updates that incorporate the FDB flush fix as soon as they are available
On unpatched hosts, avoid issuing filtered bulk FDB flushes against active VXLAN interfaces

Patch Information

The upstream fix keeps the last remote linked when it is the sole remaining remote, and asks the caller to destroy the entire FDB entry through vxlan_fdb_destroy(). This preserves the invariant that a reachable non-nexthop FDB entry always has at least one attached remote. Patches are available in the following stable commits: Linux Kernel Commit 2a7c2f0, Linux Kernel Commit 4bbc76e, Linux Kernel Commit 8ba68fd, Linux Kernel Commit a8820c8, and Linux Kernel Commit d5d4a7b.

Workarounds

Restrict use of filtered bulk FDB flush operations on VXLAN interfaces until the kernel patch is deployed
Where VXLAN overlays are not required, unload the vxlan kernel module to eliminate exposure
Limit privileges for processes that can manipulate FDB entries via CAP_NET_ADMIN to reduce the risk of a local trigger

bash

# Check running kernel and VXLAN module status
uname -r
lsmod | grep vxlan

# If VXLAN is not required, prevent the module from loading
echo 'install vxlan /bin/true' | sudo tee /etc/modprobe.d/disable-vxlan.conf