CVE-2026-80681 - Vulnerability Details

- vxlan: re-fetch eth header after route_shortcircuit()

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: re-fetch eth header after route_shortcircuit()

Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb).

Inside route_shortcircuit(), pskb_may_pull() can be called, which may
reallocate skb->head.

In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to
freed memory, leading to a use-after-free when dereferencing eth->h_dest.

Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().

Published: 2026-08-28

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a flaw where the Ethernet header pointer cached in vxlan_xmit() can become dangling after route_shortcircuit() reallocates skb. This use‑after‑free leads to dereferencing freed memory and may allow a crafted VXLAN packet to cause a kernel crash, potentially disrupting network packet handling. The vulnerability directly affects network packet integrity and can be exploited without user interaction if the attacker can send crafted packets to the target system.

Affected Systems

The flaw affects Linux kernel implementations that use the VXLAN module. No specific kernel versions are listed, so any build that includes the affected vxlan code and has not applied the patch is potentially vulnerable.

Risk and Exploitability

The CVSS score has not been published, and EPSS data for this issue is not available. The bug is listed as not in the CISA KEV catalog at this time. The use‑after‑free nature indicates a high impact on integrity, potentially leading to a kernel crash when an attacker crafts VXLAN packets that trigger route_shortcircuit() and cause the stale pointer dereference. Attackers would need remote network access to send such packets, making the risk primarily remote network‑based exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ae8840825605f36f98f247323edc150e761cb64e`	affected	< 6375093eb45cd7d89f1945f939eeae3b29d79f56
`ae8840825605f36f98f247323edc150e761cb64e`	affected	< 1b7f7b653e3557690047c62f03b80a24ea5a58a5
`ae8840825605f36f98f247323edc150e761cb64e`	affected	< bf045341dfb3e767f0ff94cf240ce3c371973bd4
`ae8840825605f36f98f247323edc150e761cb64e`	affected	< 2355c8c26d2aa1b4385b369e67202e47d460d555
`ae8840825605f36f98f247323edc150e761cb64e`	affected	< 1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585
`ae8840825605f36f98f247323edc150e761cb64e`	affected	< 1235e017aa11cf01e91b613c4c5ed6aa28934fff
`ae8840825605f36f98f247323edc150e761cb64e`	affected	< c9dceac9e1c7c772c43c732fc0d325e72835801a
`ae8840825605f36f98f247323edc150e761cb64e`	affected	< 1395a676ec15a0a02a2a6d86602324f2d5fd41d5

Linux

affected

Version	Status	Constraints
`3.10`	affected	—
`0`	unaffected	< 3.10
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ae8840825605f36f98f247323edc150e761cb64e,6375093eb45cd7d89f1945f939eeae3b29d79f56)`	affected	code_commit	—
`[ae8840825605f36f98f247323edc150e761cb64e,1b7f7b653e3557690047c62f03b80a24ea5a58a5)`	affected	code_commit	—
`[ae8840825605f36f98f247323edc150e761cb64e,bf045341dfb3e767f0ff94cf240ce3c371973bd4)`	affected	code_commit	—
`[ae8840825605f36f98f247323edc150e761cb64e,2355c8c26d2aa1b4385b369e67202e47d460d555)`	affected	code_commit	—
`[ae8840825605f36f98f247323edc150e761cb64e,1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585)`	affected	code_commit	—
`[ae8840825605f36f98f247323edc150e761cb64e,1235e017aa11cf01e91b613c5ed6aa28934fff)`	affected	code_commit	—
`[ae8840825605f36f98f247323edc150e761cb64e,c9dceac9e1c7c772c43c732fc0d325e72835801a)`	affected	code_commit	—
`[ae8840825605f36f98f247323edc150e761cb64e,1395a676ec15a0a02a2a6d86602324f2d5fd41d5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.10`	affected	semver	—
`[0,3.10)`	unaffected	semver	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that incorporates the vxlan header re-fetch fix.
If a timely kernel update is unavailable, restrict VXLAN traffic to trusted networks or disable the VXLAN module until a patch is applied.
Configure a traffic filter or firewall to block or rate‑limit VXLAN packets on untrusted interfaces.

Generated by OpenCVE AI on August 28, 2026 at 12:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff
https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5
https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585
https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5
https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555
https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56
https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4
https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a

History

Fri, 28 Aug 2026 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 28 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after route_shortcircuit() Before route_shortcircuit(), the eth header pointer is cached from eth_hdr(skb). Inside route_shortcircuit(), pskb_may_pull() can be called, which may reallocate skb->head. In this case, returning to vxlan_xmit() leaves the cached eth pointer pointing to freed memory, leading to a use-after-free when dereferencing eth->h_dest. Fix this by updating eth = eth_hdr(skb) after calling route_shortcircuit().
Title		vxlan: re-fetch eth header after route_shortcircuit()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1235e017aa11cf01e91b613c4c5ed6aa28934fff https://git.kernel.org/stable/c/1395a676ec15a0a02a2a6d86602324f2d5fd41d5 https://git.kernel.org/stable/c/1511631b7cfc4152b10a0a9d04c7a0bf2ddf4585 https://git.kernel.org/stable/c/1b7f7b653e3557690047c62f03b80a24ea5a58a5 https://git.kernel.org/stable/c/2355c8c26d2aa1b4385b369e67202e47d460d555 https://git.kernel.org/stable/c/6375093eb45cd7d89f1945f939eeae3b29d79f56 https://git.kernel.org/stable/c/bf045341dfb3e767f0ff94cf240ce3c371973bd4 https://git.kernel.org/stable/c/c9dceac9e1c7c772c43c732fc0d325e72835801a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-28T06:52:48.896Z

Updated: 2026-08-28T06:52:48.896Z

Reserved: 2026-08-26T14:34:25.783Z

Link: CVE-2026-80681

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-28T08:16:53.473

Modified: 2026-08-28T08:16:53.473

Link: CVE-2026-80681

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-28T13:30:06Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object