CVE-2026-98023

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) driver. A local user with network administration privileges can cause a Denial of Service (DoS) by configuring dynamic forwarding database (FDB) entries that reference a shared next-hop group across multiple devices. This improper configuration leads to a race condition during entry aging and cleanup, causing memory corruption through a use-after-free condition that crashes the system.

A race condition in the VXLAN FDB nexthop handling can corrupt a shared per nexthop FDB list when dynamic entries on multiple VXLAN devices are aged or modified concurrently. The race can result in list corruption and a slab use after free in vxlan_fdb_destroy. For the CVSS the PR:L rating is used because reliable triggering requires a local process that can configure VXLAN devices, nexthop objects, and FDB entries through network administration capabilities. The issue is not directly triggered by ordinary VXLAN packet traffic because affected FDB nexthop entries are configured from userspace and cannot be learned or roam. Impact is at least a local denial of service through kernel memory corruption and crash. In the worst case the confirmed use after free and list corruption may permit confidentiality or integrity impact and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.