CVE-2026-97965

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) driver. When transmitting network packets on devices configured with Group Based Policy (GBP) metadata, the driver fails to properly initialize an internal stack variable if packet flags are omitted. This issue allows residual kernel stack data to be written into outgoing packet headers, resulting in information disclosure across the network.

An uninitialized stack vxlan_metadata structure can be used when a VXLAN device enables both collect metadata and GBP, but the external ip_tunnel_info does not include the VXLAN option flag. A packet sent through the affected VXLAN egress path can then carry stack derived bits in the GBP header, including a 16 bit policy_id field. This is network reachable only in deployments using this specific flow based VXLAN configuration. For the CVSS the PR:N value reflects that an attacker may only need to send traffic through an already configured affected VXLAN forwarding path and does not necessarily need local access to the host. The confirmed impact is limited kernel stack information disclosure. The paranoid score also assigns limited integrity impact because corrupted GBP flags or policy metadata may affect handling at the remote VXLAN endpoint. No memory corruption, privilege escalation, or denial of service primitive is demonstrated by the patch.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.