{"id":29178,"date":"2026-09-25T20:32:03","date_gmt":"2026-09-25T12:32:03","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98023"},"modified":"2026-09-25T20:32:03","modified_gmt":"2026-09-25T12:32:03","slug":"cve-2026-98023","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98023","title":{"rendered":"CVE-2026-98023 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: reject dynamic"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>vxlan: reject dynamic fdb entries that reference a nexthop id<\/p>\n<p>The commit cited in the Fixes tag allowed VXLAN FDB entries to point to<br \/>\nFDB nexthops so that overlay traffic could be load balanced across<br \/>\nmultiple VTEPs. Such entries can only be configured from user space,<br \/>\ncannot be learned and cannot roam. They only make sense with a user space<br \/>\ncontrol plane such as E-VPN where data plane learning is disabled.<\/p>\n<p>Despite that, the VXLAN driver does not currently prevent such entries<br \/>\nfrom being configured with the &#8220;dynamic&#8221; flag. The per-nexthop FDB list<br \/>\nis only protected by the per-device hash lock, which is not sufficient<br \/>\nwhen two VXLAN devices point to the same FDB nexthop and therefore share<br \/>\nthe list. Aging runs in softirq context without RTNL, so an entry deleted<br \/>\nby one device can race with an addition or deletion from the other,<br \/>\nleading to list corruption:<\/p>\n<p>  list_del corruption. next-&gt;prev should be ffff8881069d9548, but was<br \/>\n  dead000000000122. (next=ffff8881069d9448)<br \/>\n  WARNING: CPU: 0 PID: 90 at lib\/list_debug.c:65<br \/>\n  __list_del_entry_valid_or_report+0x1aa\/0x210<br \/>\n  &#8230;<br \/>\n   vxlan_fdb_destroy+0x5b8\/0xad0<br \/>\n   vxlan_cleanup+0x328\/0x450<br \/>\n   call_timer_fn+0x2a\/0x1c0<br \/>\n   run_timer_softirq+0x18c\/0x210<br \/>\n  BUG: KASAN: slab-use-after-free in vxlan_fdb_destroy<\/p>\n<p>Fix this by rejecting the bogus configuration of dynamic FDB entries that<br \/>\npoint to FDB nexthops, both when created and when an existing entry is<br \/>\nupdated. As such, the per-nexthop FDB list is only ever mutated under the<br \/>\nRTNL lock. Add test cases to make sure that this does not regress in the<br \/>\nfuture.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>vxlan: reject dynamic fdb entries that reference a nexthop id<\/p>\n<p>The commit cited in the Fixes tag allowed VXLAN FDB entries to point<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29178","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}