CVE-2026-89776 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory.
Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Linux Kernel Virtual Extensible LAN implementation contains a critical information disclosure vulnerability within its VNI filter entry policy handling, specifically concerning the processing of IPv4 and IPv6 group attributes. This flaw arises from an insufficient validation mechanism for Network Link Attribute (NLA) payloads during netlink message parsing. The kernel's attribute validation logic previously defined GROUP and GROUP6 address attributes using a binary type with only a maximum length constraint rather than enforcing strict size requirements. Consequently, the validate_nla function accepted payload data that was shorter than the expected fixed-size network address structure, failing to detect truncated inputs before they were processed by downstream consumers.
The technical root cause lies in how these short attributes are consumed within the kernel codebase. The GROUP consumer utilizes nla_get_in_addr(), which performs an unconditional four-byte memory load regardless of the actual payload length provided by the user space application. When a malicious actor submits a netlink message containing a GROUP attribute with fewer than four bytes, this function reads beyond the end of the valid input buffer. This out-of-bounds read accesses up to three additional bytes from adjacent uninitialised slab cache memory. Because these memory regions are not zeroed or sanitized prior to allocation in many contexts, they may contain sensitive data such as stack variables, kernel pointers, or other process information that was previously stored but not yet overwritten.
The operational impact of this vulnerability is the potential leakage of arbitrary kernel memory contents to unprivileged users with netlink access capabilities. The corrupted remote_ip variable, populated by reading uninitialized slab data, is subsequently echoed back to the user space application through RTM_GETTUNNEL messages. This creates a direct information disclosure channel that allows attackers to probe internal kernel state and potentially gather intelligence useful for further exploitation attempts against the system or other processes running on the same host. The severity of this issue is compounded by its location within network virtualization infrastructure, which is often exposed in cloud environments where multi-tenant isolation relies heavily on correct enforcement of boundary checks between user space configuration tools and kernel networking stacks.
From a classification perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read, as the application reads data beyond the intended buffer boundaries due to improper validation of input length. It also relates to CWE-20 Improper Input Validation, specifically regarding failure to enforce expected format constraints for network address attributes. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates Information Discovery techniques where an adversary gathers system information from the local environment or remote resources via netlink interfaces. The vulnerability is particularly relevant in contexts involving container orchestration and software-defined networking platforms that rely on VXLAN encapsulation for overlay network management.
To mitigate this risk, the kernel developers have implemented a fix by switching both GROUP and GROUP6 entries to use NLA_POLICY_EXACT_LEN(). This change enforces strict length validation at the netlink attribute parsing stage, ensuring that any submitted address must be exactly four bytes for IPv4 or sixteen bytes for IPv6. By rejecting payloads that do not match these exact lengths before they reach the consumer functions like nla_get_in_addr(), the kernel prevents the out-of-bounds memory access entirely. System administrators should apply this patch immediately to their Linux kernels, particularly those running network virtualization services or VXLAN-based overlay networks. Regular updates to the base operating system and associated networking components are essential to maintain defense-in-depth against such low-level input validation failures that can lead to significant confidentiality breaches in production environments.