CVE-2026-89776vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory. Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f9c4bb0b245cee35ef66f75bf409c9573d934cf9 before e12c4663529699f457b2988c1dfedf4d13b3b3be; from f9c4bb0b245cee35ef66f75bf409c9573d934cf9 before 47bfcc871576eaef6c8edab6749acd4b317306ea; from f9c4bb0b245cee35ef66f75bf409c9573d934cf9 before a9ec10815199f9879ba080241dc555efb1daf324; from f9c4bb0b245cee35ef66f75bf409c9573d934cf9 before daebc7064a1b4c12c98e52c4bceede7f2fcd573c; from f9c4bb0b245cee35ef66f75bf409c9573d934cf9 before ad32e564c62ebf5ba76dd60a22af52c69d54d17b; from f9c4bb0b245cee35ef66f75bf409c9573d934cf9 before 984f831dda31b3a18f47454cf64989f65402879e | CNA record |
References
- https://git.kernel.org/stable/c/e12c4663529699f457b2988c1dfedf4d13b3b3be
- https://git.kernel.org/stable/c/47bfcc871576eaef6c8edab6749acd4b317306ea
- https://git.kernel.org/stable/c/a9ec10815199f9879ba080241dc555efb1daf324
- https://git.kernel.org/stable/c/daebc7064a1b4c12c98e52c4bceede7f2fcd573c
- https://git.kernel.org/stable/c/ad32e564c62ebf5ba76dd60a22af52c69d54d17b
- https://git.kernel.org/stable/c/984f831dda31b3a18f47454cf64989f65402879e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.