CVE-2026-80681

The Linux kernel's VXLAN (Virtual eXtensible LAN) driver contains a use-after-free in its packet transmit path (vxlan_xmit). When sending VXLAN-encapsulated traffic, the driver caches a pointer to the packet's Ethernet header before calling route_shortcircuit(); if that function invokes pskb_may_pull(), the socket buffer can be reallocated and the cached pointer is left dangling, so the subsequent read of eth->h_dest dereferences freed memory. An attacker who can inject or influence traffic traversing a system's VXLAN interface can trigger the bug, with a crash/kernel denial of service as the likely outcome and potential for broader kernel memory corruption; the CVSS 9.8 score reflects a worst-case unauthenticated network vector. Affected systems are Linux hosts with VXLAN in use, which is common on Kubernetes nodes using VXLAN-based CNIs and in data-center/cloud overlay networks; hosts with no VXLAN configured are not exposed. There is currently no known exploitation, no public proof-of-concept, and the CVE is not in CISA KEV, with EPSS estimating a 0.5% chance of exploitation in the next 30 days.

What to do: Track your distribution's kernel updates and apply the upstream fix ('vxlan: re-fetch eth header after route_shortcircuit()') as soon as it is backported; the source data does not specify fixed version numbers. In the interim, restrict which peers or underlay sources can send VXLAN traffic (standard UDP port 4789) to your hosts, and audit systems with 'ip -d link show type vxlan' to confirm whether VXLAN is actually in use, since hosts without VXLAN interfaces are not affected.