CVE-2026-89776

A flaw was found in the Linux kernel's VXLAN VNI filter. The system does not enforce an exact length for GROUP/GROUP6 address attributes. A remote attacker could exploit this by sending a malformed attribute, leading to an over-read of uninitialized kernel memory. This information is then disclosed back to the attacker, resulting in an information disclosure vulnerability.

This vulnerability is rated as Moderate impact because exploitation requires local access with network administrative capabilities to submit netlink configuration requests, significantly limiting the attack surface. An attacker who interacts with the VXLAN VNI filter interface can read up to three bytes of uninitialized kernel slab memory, restricting the impact strictly to local information disclosure without permitting execution or modification of system state. Additionally, earlier enterprise releases such as Red Hat Enterprise Linux 8 do not contain the underlying VNI filtering code and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.