Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-80681Vulnerabilidad crítica de Use-After-Free en el Kernel de Linux

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().

Ver en NVD

Análisis

A critical use-after-free vulnerability has been identified in the Linux kernel's VXLAN implementation. This flaw can lead to memory corruption or potential remote code execution in environments using VXLAN overlay networks, which are common in Docker, Kubernetes, and cloud infrastructure.

Roles relevantes

LinuxCloudKubernetesDockerBackendciberseguridad

Severidad

Puntaje: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH

EPSS

Probabilidad de explotación (próx. 30 días): 0.0018 (0.2%)
Percentil: 7.2%
EPSS: 2026-08-28

Descripción técnica

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().

Publicada: 28/8/2026, 8:16:53
Última modificación: 29/8/2026, 7:16:50

Referencias

InicioEventosBlogRecursosCursosEquipo