Use-After-Free Vulnerability in Linux Kernel Affecting VXLAN Functionality

CVE-2026-98122

What is CVE-2026-98122?

A use-after-free vulnerability exists within the Linux kernel's VXLAN implementation, specifically in the management of multicast database entries. The issue arises when validating source addresses in the vxlan_mdb_remote_src_del() function, where an all-zeros address can inadvertently lead to incorrect memory handling. This flaw allows an unprivileged user to manipulate MDB operations within a user and network namespace, potentially leading to system instability or unauthorized access to sensitive information. An important security fix is to reject the all-zeros address in vxlan_mdb_is_valid_source(), thus preventing the reliance on invalid entries and ensuring the integrity of network communications.

References