CVE-2026-80838

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) component. During certain network operations, specifically a filtered bulk flush, the system can incorrectly handle remote entries. This can lead to a memory corruption vulnerability where a read-copy update (RCU) reader attempts to access an invalid memory location. An attacker could potentially exploit this to cause a denial of service, making the system unavailable.

A race in the VXLAN FDB flush path can temporarily leave a reachable non-nexthop FDB entry with an empty remotes list. An RCU reader can still find the parent FDB entry during this window and first_remote_rcu can derive an invalid vxlan_rdst pointer from the empty list head. The receive learning path may then read from and write through that invalid remote pointer which makes this a memory corruption candidate rather than a simple resource leak. For the CVSS the PR:L is used for the paranoid case because delegated CAP_NET_ADMIN or container-root network administration can be enough to perform FDB flush operations in some deployments. The issue is not directly network-triggerable by packets alone but VXLAN receive processing can participate in the race once the local control plane operation is triggered. Impact is at least denial of service and in the worst defensible case may include confidentiality and integrity impact due to invalid pointer read/write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.