Skip to main content

Linux Kernel CVE-2026-93250

| EUVDEUVD-2026-86262 HIGH
2026-09-24 Linux GHSA-xj6p-hw9r-5g4r
Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain CAP_NET_ADMIN in a namespace
  2. Delivery
    Create VXLAN device with (*, G) and (S, G) MDB entries
  3. Exploit
    Trigger flush via device delete or RTM_DELMDB NLM_F_BULK
  4. Execution
    Freed (S, G) entry re-deleted (UAF)
  5. Persist
    Kernel memory corruption
  6. Impact
    DoS or local privilege escalation

Vulnerability Assessment

Exploitation Conditions

Requires local access with CAP_NET_ADMIN (in the initial or a user namespace) to manipulate VXLAN devices via netlink. The vulnerable path is only reachable when a VXLAN device has MDB (multicast database) entries configured - specifically a (*, G) entry with a source list that creates (S, G) entries, arranged so an (S, G) entry sits after its parent (*, G) in the hash list (achieved by adding the (S, G) before the (*, G) with NLM_F_REPLACE). The flush is then triggered by deleting the VXLAN device (RTM_DELLINK) or by RTM_DELMDB with NLM_F_BULK. Limiting factors: no remote or unauthenticated path, requires CAP_NET_ADMIN, and requires a non-default VXLAN MDB/multicast-snooping configuration - systems not using VXLAN MDB are unaffected.
Impact

This is a Linux kernel use-after-free (memory corruption, CWE-416-class - NOT information disclosure as the 'Information Disclosure' tag implies) in vxlan_mdb_flush(), where hlist_for_each_entry_safe() saves a next-pointer to an (S, G) entry that is subsequently freed while the (*, G) entry is processed, leading to a double hlist_del() writing LIST_POISON1 to LIST_POISON2. The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is internally consistent and defensible: the trigger is netlink-driven (RTM_DELLINK device teardown or RTM_DELMDB with NLM_F_BULK), which requires CAP_NET_ADMIN - hence local vector and PR:L rather than PR:N. No EPSS score, no CISA KEV listing, and no public exploit are provided, so exploitation status is 'no public exploit identified at time of analysis'; the KASAN splat in the report is a crash reproducer, not a weaponized privilege-escalation exploit. Realistically this is a moderate-priority kernel hardening fix: high theoretical impact (kernel UAF can escalate to LPE) but gated behind CAP_NET_ADMIN and a specific VXLAN MDB configuration, so it is not a mass-exploitable network-facing bug despite the 7.8 score. Note the AV:L/PR:L combination means an attacker must already hold significant local network-admin capability, which substantially narrows real-world risk.
Exploit ScenarioDerived

A local user or container/namespace holding CAP_NET_ADMIN configures a VXLAN device with MDB (*, G) entries whose source lists spawn (S, G) entries in an ordering that places an (S, G) entry after its parent (*, G) in the hash list, then deletes the device or issues RTM_DELMDB with NLM_F_BULK to trigger the flush. The resulting use-after-free corrupts kernel memory (double hlist_del), enabling denial of service and potentially local privilege escalation. No public exploit code is identified; only a KASAN crash reproducer using the 'ip' tool is described in the report.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A use-after-free in the Linux kernel's VXLAN multicast database (MDB) handling allows a local attacker who holds CAP_NET_ADMIN (including within a user namespace) to corrupt kernel memory by manipulating VXLAN MDB entries and then triggering a flush. The bug lives in vxlan_mdb_flush(), which iterates the MDB hash list with hlist_for_each_entry_safe() under the false assumption that only the current entry can be removed; flushing the remotes of a (*, G) entry actually cascades into removal of the associated (S, G) entries, one of which may be the saved next-pointer, producing a double hlist_del() that writes LIST_POISON1 into LIST_POISON2 and yields attacker-influenced memory corruption (KASAN reported wild-memory-access). Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) the impact is high for confidentiality, integrity and availability, but exploitation requires local privileges, CAP_NET_ADMIN, and a non-default VXLAN MDB configuration; there is no remote or unauthenticated path. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); vendor-released patches exist for the affected stable branches.

RemediationAI

Vendor-released patches are available: upgrade to Linux 6.6.157, 6.12.110, 6.18.52, 7.2.6 or 7.3-rc1 (or later), which incorporate the upstream fixes referenced in the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-93250 and the stable git.kernel.org commits f8a9b988e7a7bc674e74e8c901794d792c35689e, c7dc26d06f90ca11bbd6114f6a62a67d038816c7, 3e6b705bc162fc7257645725a7d2cf6c71250318, f26400b325bdc2868e40612c4804c82cf8ba6275 and bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366; distributions shipping a 6.4-or-later kernel should take their backported kernel update. If immediate patching is not possible, the practical compensating control is to reduce exposure to the vulnerable code path: the bug is only reachable when a VXLAN interface has MDB entries configured, so avoid configuring VXLAN multicast/MDB state - specifically (*, G) entries with source lists that generate (S, G) entries - and remove existing MDB entries from VXLAN devices before any interface teardown (note that deleting such entries via RTM_DELMDB with NLM_F_BULK is itself a trigger, so prefer non-bulk deletion or simply do not create the entries). Because triggering requires CAP_NET_ADMIN in the initial or a user namespace, restricting who can create network namespaces and manage VXLAN/rtnetlink configuration (for example, disabling unprivileged user namespaces where this is not operationally required) removes the local attack surface; the trade-off is loss of unprivileged container/sandbox networking features that rely on user namespaces. Keeping the kernel current remains the only complete fix, as these workarounds reduce reachability rather than repairing the double hlist_del().

Affected VersionsENISA

Linux a3a48de5eade770e911d35291217bdd69ce04ef1 <bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366
Linux patch: 6.6.157
Linux a3a48de5eade770e911d35291217bdd69ce04ef1 <f8a9b988e7a7bc674e74e8c901794d792c35689e
Linux a3a48de5eade770e911d35291217bdd69ce04ef1 <c7dc26d06f90ca11bbd6114f6a62a67d038816c7
Linux patch: 6.18.52
Linux a3a48de5eade770e911d35291217bdd69ce04ef1 <3e6b705bc162fc7257645725a7d2cf6c71250318
Linux 6.4
Linux patch: 7.3-rc1
Linux patch: 6.12.110
Linux a3a48de5eade770e911d35291217bdd69ce04ef1 <f26400b325bdc2868e40612c4804c82cf8ba6275
Linux patch: 7.2.6
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

VXLAN implements multicast-style forwarding through a multicast database (MDB) managed over rtnetlink via RTM_NEWMDB/RTM_DELMDB and exposed by the vxlan driver's mdb module. The MDB stores group entries in a hash list: a (*, G) wildcard-group entry can carry a source list, and each source can have a corresponding (S, G) source-specific entry. The flaw is a TOCTOU-style list-invariant violation inside vxlan_mdb_flush(): the loop uses hlist_for_each_entry_safe(), which is only safe when nothing other than the current entry is unlinked during the iteration, but draining a (*, G) entry's remotes cascades through vxlan_mdb_remotes_flush() -> vxlan_mdb_remote_del() -> vxlan_mdb_remote_srcs_del() -> vxlan_mdb_remote_src_del() -> vxlan_mdb_remote_src_fwd_del() -> __vxlan_mdb_del() -> vxlan_mdb_entry_put(), freeing (S, G) entries that may sit after the (*, G) entry in the list. Because vxlan_mdb_entry_get() returns an existing entry without promoting it to the head of the list, ordering can be arranged so the (S, G) entry is added first and the (*, G) entry second with NLM_F_REPLACE (adding the source to a pre-existing (*, G) would otherwise fail with -EEXIST). The saved next-pointer then refers to an already-freed node, and the next loop iteration calls hlist_del() on it again, writing LIST_POISON1 to LIST_POISON2 - the KASAN 'wild-memory-access' write of size 8 at addr dead000000000122 in vxlan_mdb_entry_put.part.0. This is a memory-corruption/UAF class defect (CWE-416-like); the 'Information Disclosure' tag attached to the CVE record is misleading and does not reflect the assessed impact of high integrity and availability loss alongside confidentiality exposure. The vulnerable code is reachable both from device teardown (unregister_netdevice_many_notify -> vxlan_uninit -> vxlan_mdb_fini -> vxlan_mdb_flush, i.e. RTM_DELLINK) and from RTM_DELMDB with NLM_F_BULK.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Trigger requires CAP_NET_ADMIN via local netlink (AV:L, PR:L); deterministic once the entry ordering is set (AC:L); kernel UAF yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
7.8 (HIGH)
Patch available
Sep 24, 2026 - 17:18 EUVD
CVE Published
Sep 24, 2026 - 15:51 cve.org
HIGH 7.8
CVE Published
Sep 24, 2026 - 15:51 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()

vxlan_mdb_flush() iterates over the MDB entries using hlist_for_each_entry_safe(), which only tolerates the removal of the current entry. Contrary to the comment above the loop, the removal of an entry can trigger the removal of another entry.

Flushing the remotes of a (*, G) entry also removes the (S, G) entries that were created for its source list, once they are left without remotes:

vxlan_mdb_remotes_flush() -> vxlan_mdb_remote_del() -> vxlan_mdb_remote_srcs_del() -> vxlan_mdb_remote_src_del() -> vxlan_mdb_remote_src_fwd_del() -> __vxlan_mdb_del() -> vxlan_mdb_entry_put()

Such an entry can be located after the (*, G) entry in the list, as vxlan_mdb_entry_get() returns an existing entry without moving it to the head of the list. This order is obtained by adding the (S, G) entry before the (*, G) entry, the latter with NLM_F_REPLACE, as the addition of the source otherwise fails with -EEXIST. The (S, G) entry is then the entry saved by hlist_for_each_entry_safe() and it is freed while the (*, G) entry is processed. The next iteration calls hlist_del() on it again, writing LIST_POISON1 to LIST_POISON2 [1].

Besides device deletion, the flush is also reachable from RTM_DELMDB with NLM_F_BULK.

Fix by re-reading the next entry after the remotes were flushed. The current entry cannot be removed by this flush, as source lists can only be configured on (*, G) entries and the removed entries are (S, G) entries. It is therefore still linked and its next pointer reflects the removals.

[1] BUG: KASAN: wild-memory-access in vxlan_mdb_entry_put.part.0+0x328/0x588 Write of size 8 at addr dead000000000122 by task ip/327

CPU: 3 UID: 1000 PID: 327 Comm: ip Not tainted 7.2.0-rc7 #2 PREEMPT Call trace: vxlan_mdb_entry_put.part.0+0x328/0x588 vxlan_mdb_flush+0x1d8/0x25c vxlan_mdb_fini+0x8c/0x100 vxlan_uninit+0x1c/0x7c unregister_netdevice_many_notify+0x954/0xd4c rtnl_dellink+0x210/0x530 rtnetlink_rcv_msg+0x434/0x4d0 netlink_rcv_skb+0xc4/0x204 rtnetlink_rcv+0x18/0x24 netlink_unicast+0x4b8/0x548 netlink_sendmsg+0x29c/0x560 ____sys_sendmsg+0x390/0x3ec ___sys_sendmsg+0x114/0x188 __sys_sendmsg+0xf0/0x178 __arm64_sys_sendmsg+0x48/0x60 invoke_syscall.constprop.0+0x58/0x180 el0_svc_common.constprop.0+0x74/0x140 do_el0_svc+0x30/0x40 el0_svc+0x38/0x98 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c

Executive ViewAI

Why It Matters

A memory-corruption vulnerability in the Linux kernel's VXLAN multicast database handling can allow a local user with elevated network privileges to take full control of affected hosts, which is a serious risk for virtualization, container and multi-tenant platforms built on VXLAN overlays. Although no public exploit identified at time of analysis, exploitation requires an authenticated local account holding CAP_NET_ADMIN (obtainable within user namespaces on many distributions) plus a non-default VXLAN multicast database configuration, so internet-facing systems are not directly exposed. Leadership should prioritize patching shared hypervisors, Kubernetes/container nodes and network gateway hosts, where a single compromised kernel affects every tenant or workload on that machine.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 96% exploitable
Prevalence
Ubiquitous
Linux kernel runs across the vast majority of server and cloud environments
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93250 REF https://git.kernel.org/stable/c/3e6b705bc162fc7257645725a7d2cf6c71250318 REF https://git.kernel.org/stable/c/bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366 REF https://git.kernel.org/stable/c/c7dc26d06f90ca11bbd6114f6a62a67d038816c7 REF https://git.kernel.org/stable/c/f26400b325bdc2868e40612c4804c82cf8ba6275 REF https://git.kernel.org/stable/c/f8a9b988e7a7bc674e74e8c901794d792c35689e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy