CVE-2026-98568

A flaw was found in the Linux kernel's VXLAN (Virtual Extensible LAN) networking module. A race condition can occur when link properties are modified while neighbour advertisement reply packets are being processed, leading to inconsistent buffer size calculations. A local attacker could exploit this timing issue to cause an out-of-bounds write to kernel memory, resulting in a Denial of Service (DoS) via a system crash or potential memory corruption.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because triggering the flaw requires winning a tight time-of-check to time-of-use (TOCTOU) race condition during link property modifications, which typically requires administrative network privileges. On default configurations where VXLAN tunnels are not configured or dynamically modified, unprivileged users cannot trigger the out-of-bounds write. While successful exploitation can cause kernel memory corruption leading to a system crash and local denial of service, it cannot be exploited remotely without local link modification privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.