CVE-2026-80681vxlan: re-fetch eth header after route_shortcircuit()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ae8840825605f36f98f247323edc150e761cb64e before 6375093eb45cd7d89f1945f939eeae3b29d79f56; from ae8840825605f36f98f247323edc150e761cb64e before 1b7f7b653e3557690047c62f03b80a24ea5a58a5; from ae8840825605f36f98f247323edc150e761cb64e before bf045341dfb3e767f0ff94cf240ce3c371973bd4; from ae8840825605f36f98f247323edc150e761cb64e before 2355c8c26d2aa1b4385b369e67202e47d460d555; from ae8840825605f36f98f247323edc150e761cb64e before 1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585; from ae8840825605f36f98f247323edc150e761cb64e before 1235e017aa11cf01e91b613c4c5ed6aa28934fff; from ae8840825605f36f98f247323edc150e761cb64e before c9dceac9e1c7c772c43c732fc0d325e72835801a; from ae8840825605f36f98f247323edc150e761cb64e before 1395a676ec15a0a02a2a6d86602324f2d5fd41d5 | CNA record |
References
- https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56
- https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5
- https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4
- https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555
- https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585
- https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff
- https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a
- https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.