CVE-2026-89776: Linux Kernel VXLAN Information Disclosure

CVE-2026-89776 Overview

CVE-2026-89776 is an information disclosure vulnerability in the Linux kernel's VXLAN (Virtual Extensible LAN) VNI filter implementation. The flaw exists in the vxlan_vnifilter netlink attribute policy, which declared the GROUP and GROUP6 address attributes as NLA_BINARY with only a maximum length constraint. This permitted validate_nla() to accept payloads shorter than a full IPv4 or IPv6 address. When the consumer read the attribute with nla_get_in_addr(), an unconditional 4-byte load occurred, over-reading up to 3 bytes of uninitialised slab memory that were then echoed back through RTM_GETTUNNEL, leaking kernel memory to userspace.

Critical Impact
A local user with CAP_NET_ADMIN in the initial namespace can disclose uninitialised kernel slab memory by submitting undersized GROUP/GROUP6 attributes and reading them back via RTM_GETTUNNEL.

Affected Products

Linux kernel branches containing the VXLAN VNI filter implementation prior to the fix commits
Distributions shipping vulnerable upstream kernel versions
Systems using VXLAN with VNI filtering enabled

Discovery Timeline

2026-09-16 - CVE-2026-89776 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89776

Vulnerability Analysis

The VXLAN VNI filter entry policy in the Linux kernel networking stack defined the multicast group address attributes (GROUP for IPv4, GROUP6 for IPv6) as NLA_BINARY type with only a maximum length declaration. The netlink attribute validator validate_nla() therefore accepted any payload up to the declared maximum, including truncated buffers shorter than a real address.

Downstream code paths treated the attribute as a fixed-width address. Specifically, nla_get_in_addr() performs an unconditional 4-byte load from the attribute payload. When a caller supplied a shorter buffer, the load extended past the attribute data into adjacent uninitialised slab memory. These bytes were copied into the remote_ip field of the resulting VNI entry.

Because the kernel later serialised the same remote_ip value in response to an RTM_GETTUNNEL query, the disclosed uninitialised bytes were returned to the requesting process. This information disclosure primitive can reveal fragments of neighbouring slab allocations, aiding kernel address leaks and defeating KASLR mitigations.

Root Cause

The root cause is missing exact-length validation on netlink attributes that are consumed as fixed-size structures. NLA_BINARY with only .len enforces an upper bound, not a required size, so a length mismatch between validation and consumption produced an out-of-bounds read into slab memory [CWE-908, CWE-125].

Attack Vector

Exploitation requires local access with sufficient netlink privileges to configure VXLAN devices, typically CAP_NET_ADMIN. An attacker sends an RTM_NEWTUNNEL message containing a GROUP or GROUP6 attribute shorter than 4 or 16 bytes, then issues an RTM_GETTUNNEL query to read the echoed remote_ip field and harvest the leaked kernel bytes.

A verified public exploit is not currently available. Refer to the upstream commits for the corrected policy definitions and consumer paths.

Detection Methods for CVE-2026-89776

Indicators of Compromise

Unexpected RTM_NEWTUNNEL netlink messages targeting VXLAN devices with malformed IFLA_VXLAN_GROUP or IFLA_VXLAN_GROUP6 attribute lengths
Processes without a legitimate networking role invoking AF_NETLINKNETLINK_ROUTE sockets to manipulate VXLAN VNI filter entries
Repeated RTM_GETTUNNEL queries following VNI filter modifications from the same process

Detection Strategies

Audit netlink activity with the Linux audit subsystem to record processes issuing RTM_NEWTUNNEL and RTM_GETTUNNEL calls
Alert on non-root or non-service accounts holding CAP_NET_ADMIN and interacting with VXLAN configuration interfaces
Correlate rapid create-then-read sequences against VNI filter entries, which are characteristic of the leak primitive

Monitoring Recommendations

Enable kernel memory sanitizers such as KMSAN in test environments to surface uninitialised memory reads during VXLAN operations
Track kernel version inventory across the fleet and flag hosts running kernels that lack the NLA_POLICY_EXACT_LEN() fix
Baseline expected VXLAN administrative activity and alert on deviations, particularly from container or workload namespaces

How to Mitigate CVE-2026-89776

Immediate Actions Required

Apply the upstream stable kernel updates that switch GROUP and GROUP6 attributes to NLA_POLICY_EXACT_LEN()
Restrict CAP_NET_ADMIN to trusted administrative accounts and services only
Disable VXLAN modules on hosts that do not require overlay networking using modprobe blacklists

Patch Information

The fix enforces exact-length validation for the GROUP and GROUP6 netlink attributes so the validator rejects any payload that is not exactly 4 or 16 bytes. Corrected commits are available in the upstream stable trees: Commit 47bfcc8, Commit 984f831, Commit a9ec108, Commit ad32e56, Commit daebc70, and Commit e12c466.

Workarounds

Remove CAP_NET_ADMIN from container workloads and unprivileged users where possible
Blacklist the vxlan kernel module on hosts that do not require overlay networking
Enforce user namespace restrictions with kernel.unprivileged_userns_clone=0 to reduce the attack surface for netlink-based primitives

bash

# Configuration example: disable the vxlan module on hosts that do not need it
echo 'install vxlan /bin/true' | sudo tee /etc/modprobe.d/disable-vxlan.conf
sudo rmmod vxlan 2>/dev/null || true

# Verify current kernel version against patched builds
uname -r