CVE-2026-98122

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) driver. A local unprivileged attacker can cause a denial of service (DoS) or potentially escalate privileges through memory corruption. This vulnerability occurs because the Multicast Database (MDB) subsystem improperly validates all-zero network addresses, causing internal database entries to conflict. When these conflicting entries are deleted, the kernel accesses already freed memory, leading to a system crash or arbitrary code execution.

A use after free in the VXLAN MDB control path occurs when an all zero source address causes a derived S G entry key to alias the original star G entry key. Removing the aliased forwarding entry frees the source entry, after which hlist_del operates on the freed object and reads pprev and next pointers before writing through them. An unprivileged local user can perform MDB operations from a new user and network namespace where unprivileged namespace creation is permitted. For the CVSS the PR:L reflects that local user context and namespace creation are required even though host administrator privileges are not required. The issue is not directly network reachable because it is triggered through the netlink control plane rather than VXLAN packet traffic. Impact is at least a local denial of service via kernel memory corruption and in the worst case may allow confidentiality integrity and privilege impact due to the write through use after free primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.