Memory Disclosure Vulnerability in Linux Kernel Affecting VXLAN VNI Filter

CVE-2026-89776

What is CVE-2026-89776?

A vulnerability in the Linux kernel's VXLAN VNI filter allows for the over-reading of uninitialized memory due to improper validation of the GROUP/GROUP6 address attributes. The policy incorrectly designates these attributes with only a maximum length, leading to potential information leakage as the payload processed by the GROUP consumer can be shorter than expected. This results in the reading of extra bytes from the kernel heap, which are then returned via RTM_GETTUNNEL, thereby exposing sensitive kernel memory information. A remedy involves updating the validation policy to enforce the exact length of the incoming attributes, ensuring they strictly conform to the valid address formats.

References