CVE-2026-80681
vxlan: re-fetch eth header after route_shortcircuit()
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
| Vendor | linux |
| Product | linux |
| Ecosystems | |
| Industries | Technology |
| Published | Aug 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for linux linux
Be the first to know when new unknown vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Linux / Linux
ae8840825605f36f98f247323edc150e761cb64e < 6375093eb45cd7d89f1945f939eeae3b29d79f56 ae8840825605f36f98f247323edc150e761cb64e < 1b7f7b653e3557690047c62f03b80a24ea5a58a5 ae8840825605f36f98f247323edc150e761cb64e < bf045341dfb3e767f0ff94cf240ce3c371973bd4 ae8840825605f36f98f247323edc150e761cb64e < 2355c8c26d2aa1b4385b369e67202e47d460d555 ae8840825605f36f98f247323edc150e761cb64e < 1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585 ae8840825605f36f98f247323edc150e761cb64e < 1235e017aa11cf01e91b613c4c5ed6aa28934fff ae8840825605f36f98f247323edc150e761cb64e < c9dceac9e1c7c772c43c732fc0d325e72835801a ae8840825605f36f98f247323edc150e761cb64e < 1395a676ec15a0a02a2a6d86602324f2d5fd41d5
Linux / Linux
3.10
References
git.kernel.org: https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56 git.kernel.org: https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5 git.kernel.org: https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4 git.kernel.org: https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555 git.kernel.org: https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585 git.kernel.org: https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff git.kernel.org: https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a git.kernel.org: https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5