{"id":"CVE-2026-98568","kind":"vulnerability","aliases":["CVE-2026-98568"],"related":[],"title":"Linux kernel: VXLAN neighbour reply race writes past skb buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use one headroom snapshot for neighbour replies\n\nvxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then\nsamples it again to reserve headroom. A concurrent vxlan_changelink() can\nupdate needed_headroom between the two reads, creating a TOCTOU race. The\nsecond value can exceed the allocation and make the Ethernet header write out\nof bounds.\n\nThe race is reproducible on the unpatched kernel. It occurred when\nvxlan_na_create() generated a neighbour reply while vxlan_changelink() changed\nthe link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte\nskbuff_small_head allocation.\n\nSnapshot the headroom once and use that value for both allocation and\nreservation.","summary":"A race in the Linux kernel's VXLAN driver lets a concurrent link change make the neighbour-reply code size its buffer too small. The result is an out-of-bounds write of a few bytes into kernel memory, which can corrupt the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubernetes","linux-kernel","runtime","self-hosted","vxlan"],"not_affected_if":["default-config","no-vxlan"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit using one headroom snapshot in vxlan_na_create() (the fix named in the advisory); exact fixed version unknown from the sources.","status":"open","published_at":"2026-10-18T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:15+00:00","updated_at":"2026-10-25T05:23:15+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit using one headroom snapshot in vxlan_na_create() (the fix named in the advisory); exact fixed version unknown from the sources.","reach":"local","title":"Linux kernel: VXLAN neighbour reply race writes past skb buffer","impact":"high","summary":"A race in the Linux kernel's VXLAN driver lets a concurrent link change make the neighbour-reply code size its buffer too small. The result is an out-of-bounds write of a few bytes into kernel memory, which can corrupt the kernel.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","vxlan","self-hosted","kubernetes"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory corrupted by a small out-of-bounds write, possibly code execution","analyst_note":"Check the kernel.org stable commit and NVD entry for fixed kernel versions and whether the race is remotely triggerable; sources give no version or severity.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-vxlan","default-config"],"who_is_affected":"Systems running a Linux kernel with the VXLAN driver loaded and in use, where neighbour suppression replies are generated and the VXLAN link is reconfigured at runtime. Hosts that do not use VXLAN, or that do not change VXLAN link settings while traffic flows, are much less exposed. unknown for exact trigger conditions beyond this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000634,"input_tokens":3500,"output_tokens":567,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98568':13A,16A '704':178C 'alloc':132C,183C,194C 'beyond':176C 'bound':58B,141C 'buffer':10A,48B 'byte':63B,172C,175C,179C 'caught':168C 'chang':39B,163C 'changelink':113C,162C 'code':45B 'concurr':37B,111C 'corrupt':69B 'creat':92C,122C,155C 'cve':11A,14A 'driver':34B 'ethernet':136C 'exceed':130C 'follow':77C 'four':171C 'four-byt':170C 'generat':156C 'head':182C 'header':137C 'headroom':85C,109C,117C,166C,186C 'host':24B 'kasan':167C 'kernel':2A,20B,31B,65B,71B,75C,149C 'kubernet':17B 'let':35B 'link':38B,165C 'linux':1A,19B,30B,74C 'linux-kernel':18B 'll':94C 'make':40B,134C 'memori':66B 'na':91C,154C 'need':116C 'neighbour':4A,43B,88C,158C 'neighbour-repli':42B 'occur':151C 'one':84C 'out-of-bound':55B 'past':8A 'race':6A,27B,125C,143C 'read':121C 'repli':5A,44B,89C,100C,159C 'reproduc':145C 'reserv':95C,108C,196C 'resolv':81C 'result':52B 'runtim':21B 'sampl':93C,104C 'second':127C 'self':23B 'self-host':22B 'size':46B,98C 'skb':9A,101C 'skbuff':180C 'small':50B,181C 'snapshot':86C,184C 'space':96C 'toctou':124C 'two':120C,174C 'unpatch':148C 'updat':115C 'use':83C,189C 'valu':128C,191C 'vulner':78C 'vxlan':3A,25B,33B,82C,90C,112C,153C,161C 'write':7A,59B,138C,173C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the VXLAN driver loaded and in use, where neighbour suppression replies are generated and the VXLAN link is reconfigured at runtime. Hosts that do not use VXLAN, or that do not change VXLAN link settings while traffic flows, are much less exposed. unknown for exact trigger conditions beyond this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98568","severity":null,"published_at":"2026-10-18T16:17:09+00:00","modified_at":"2026-10-19T10:19:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}