Linux Kernel EUVD-2026-26551

The VXLAN (Virtual Extensible LAN) module in the Linux kernel processes IPv6 Neighbor Advertisement (NA) messages containing Neighbor Discovery (ND) options. The vxlan_na_create() function parses these options by iterating through option blocks using length fields embedded in each option. The vulnerability stems from insufficient validation of these length fields before advancing the parser pointer or reading from option payloads. Specifically, a source LLADDR (Link-Layer Address) option with a length field smaller than required for an Ethernet address (6 bytes) could trigger out-of-bounds memory reads. Additionally, a malformed length value could cause the parser to advance beyond the bounds of the NS option area entirely. The CWE classification is not specified, but this pattern matches CWE-119 (improper restriction of operations within bounds of memory buffer) or CWE-125 (out-of-bounds read).