In the Linux kernel’s VXLAN Multicast Database (MDB), when a remote source list is replaced, the code marks all current source entries for deletion before adding the new entries. If the addition of the new sources fails, the rollback path mistakenly deletes all entries that were marked for deletion, including those that pre‑existed before the replace operation. As a result, valid source entries are incorrectly removed from the VXLAN remote entry. This corruption can cause traffic that should be blocked to be forwarded, or traffic that should be forwarded to be dropped. The flaw is a logic error in the rollback path rather than a classic memory corruption vulnerability.

All systems that run a Linux kernel which implements the VXLAN MDB feature are potentially affected. The advisory does not list specific kernel releases; the correct logic is included in later kernel commits referenced in the official Linux repository. Administrators should check whether their current kernel includes the commit series that fixes the rollback behavior. The vulnerability applies to any kernel where the vxlan_mdb_remote_srcs_add function is present in the source code.

The CVSS score is not provided, and the EPSS value is unavailable. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can initiate a VXLAN source list replace—such as a privileged process or a compromised VXLAN client—could exploit the flaw by causing a replace failure that wipes pre‑existing entries. The impact on traffic filtering suggests that systems with critical VXLAN deployments could experience significant disruption. Therefore, while the exact exploitation probability cannot be quantified, security teams should consider the risk high for environments that rely heavily on VXLAN filtering and monitoring.