CVE-2026-98568
In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan_changelink() can update needed_headroom between the two reads, creating a TOCTOU race. The second value can exceed the allocation and make the Ethernet header write out of bounds. The race is reproducible on the unpatched kernel. It occurred when vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte skbuff_small_head allocation. Snapshot the headroom once and use that value for both allocation and reservation.
Affected versions
Linux kernel versions
3.12.18,
3.13.10,
3.14
and later are affected. Fixed in
6.6.158,
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-98568?
CVE-2026-98568 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.12.18 onward and has been patched in 6.6.158, 6.12.112, 6.18.55 and others. CVE-2026-98568 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98568?
Yes. CVE-2026-98568 has been patched. Fixed versions include 6.6.158, 6.12.112, 6.18.55 and others. If you are running Linux kernel 3.12.18 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98568 actively exploited?
No. CVE-2026-98568 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.