Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-80681Critical Use-After-Free vulnerability in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().

View on NVD

Analysis

A critical use-after-free vulnerability has been identified in the Linux kernel's VXLAN implementation. This flaw can lead to memory corruption or potential remote code execution in environments using VXLAN overlay networks, which are common in Docker, Kubernetes, and cloud infrastructure.

Relevant roles

LinuxCloudKubernetesDockerBackendciberseguridad

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH

EPSS

Probability of exploitation (next 30 days): 0.0018 (0.2%)
Percentile: 7.2%
EPSS: 2026-08-28

Technical description

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().

Published: 8/28/2026, 8:16:53 AM
Last modified: 8/29/2026, 7:16:50 AM

References

HomeEventsBlogResourcesCoursesTeam