CVE-2026-80681 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
vxlan: re-fetch eth header after route_shortcircuit()
Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).
Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head.
In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest.
Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the Linux kernel's Virtual Extensible LAN (VXLAN) implementation represents a critical memory safety flaw rooted in improper pointer management during packet processing operations. Specifically, the issue resides within the vxlan_xmit function, which is responsible for transmitting VXLAN encapsulated packets over network interfaces. The core of the problem lies in how Ethernet headers are handled relative to internal routing optimizations known as route short-circuiting. Before invoking the route_shortcircuit routine, the code caches a pointer to the Ethernet header by calling eth_hdr on the socket buffer structure. This cached pointer is subsequently used later in the execution flow to access destination MAC addresses and other frame fields necessary for packet transmission or further processing.
The technical flaw emerges because the route_shortcircuit function may invoke pskb_may_pull, a kernel utility designed to ensure that sufficient data is present within the linear portion of the socket buffer for safe access. When this condition cannot be met with existing memory allocations, pskb_may_pull triggers a reallocation or expansion of the skb->head region. This operation effectively moves the underlying memory block containing packet data to a new physical address while invalidating any previously obtained pointers into that old location. Consequently, when execution returns from route_shortcircuit back to vxlan_xmit, the eth pointer remains fixed at its original cached value, which now points to freed or unmapped memory rather than the current valid Ethernet header.
This scenario creates a classic use-after-free condition where the kernel attempts to dereference stale memory references. Dereferencing this invalid pointer leads to undefined behavior that can manifest as kernel panics, system crashes, or data corruption depending on what occupies the previously allocated memory space at runtime. In worst-case scenarios involving carefully crafted network traffic, such memory safety violations could potentially be exploited for privilege escalation or denial of service attacks against vulnerable systems running affected Linux kernels with VXLAN support enabled. The vulnerability highlights a common class of bugs in high-performance networking code where performance optimizations like caching pointers are not properly synchronized with dynamic memory management operations that may relocate those buffers.
From an industry standards perspective, this flaw aligns closely with CWE-416 which describes use-after-free vulnerabilities resulting from accessing memory after it has been freed or invalidated. The attack vector typically involves sending specially crafted VXLAN encapsulated packets to trigger the specific code path where route short-circuiting occurs alongside buffer reallocation requirements. This maps to MITRE ATT&CK techniques related to exploitation of remote services and potential denial of service through resource exhaustion or system instability caused by kernel-level memory corruption. The impact extends beyond simple availability loss as corrupted state in network subsystems can lead to broader security implications including information disclosure if sensitive data resides in the reclaimed memory regions.
Mitigation strategies primarily involve applying vendor-provided patches that update the Linux kernel source code to properly refresh pointer references after any operation capable of reallocating socket buffer heads. Administrators should ensure their systems are updated with the latest stable kernels containing fixes for this VXLAN handling logic. Additionally, network segmentation and strict ingress filtering can reduce exposure by limiting which sources can send VXLAN traffic to vulnerable hosts until patches are deployed. Monitoring kernel logs for oops messages or panic traces related to vxlan_xmit may help identify active exploitation attempts in production environments where immediate patching is not feasible due to operational constraints.