CVE-2026-80681

A flaw was found in the Linux kernel's vxlan component. A use-after-free vulnerability exists due to improper handling of the Ethernet header pointer after route_shortcircuit() is called. When pskb_may_pull() reallocates the skb->head, the previously cached Ethernet header pointer becomes stale, leading to a use-after-free when eth->h_dest is dereferenced. A remote attacker could exploit this to potentially cause a denial of service or execute arbitrary code.

A use-after-free in the VXLAN transmit path can occur because vxlan_xmit caches the Ethernet header pointer before route_shortcircuit(). route_shortcircuit() may call pskb_may_pull(), which can reallocate skb head and leave the cached eth pointer stale. A packet that reaches the affected VXLAN route shortcircuit path can then cause a dereference of eth h_dest from freed memory, leading at least to kernel crash or incorrect forwarding behavior. For the CVSS the PR:N because the attacker does not need a local account if they can inject traffic into the relevant VXLAN or attached tenant network path. The attack is best modeled as AV:A because VXLAN deployments are usually limited to adjacent overlay, cloud, or data center networks rather than the public Internet. Impact is at least denial of service, with limited confidentiality or integrity impact possible in the paranoid interpretation due to a stale UAF read that influences MAC lookup.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.