CVE-2026-93250

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) networking module. This flaw allows a local user with network administration privileges to cause a Denial of Service (DoS) or potentially execute arbitrary code. The issue arises from a use-after-free condition during multicast database (MDB) flush operations, where removing an entry can trigger the premature deletion of subsequent linked entries while the kernel continues to traverse the list.

A use after free in vxlan_mdb_flush occurs when flushing remotes of a star,G MDB entry removes a related S,G entry that was saved as the next element by hlist_for_each_entry_safe. The subsequent iteration operates on the stale entry and can write list poison values through freed list pointers, resulting in kernel memory corruption or a crash. The issue is reachable through RTM_DELMDB with NLM_F_BULK and through VXLAN device deletion. For the CVSS the PR:L is used because an attacker needs local control of VXLAN MDB configuration through rtnetlink and typically CAP_NET_ADMIN. This can include a reduced capability container process with delegated network administration privileges. The issue is not directly reachable through ordinary VXLAN packet traffic. Impact is at least local denial of service via kernel crash and in the worst case may allow confidentiality or integrity impact due to the confirmed use after free write and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.