EUVD-2026-59553
GHSA-86mr-r4jr-f66c
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Race requires local tunnel-socket teardown timing (AC:H) and configured privileges (PR:L); NULL-deref causes only a kernel crash, so A:H with C:N/I:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
udp_tunnel_sock_release() could set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is running.
Let's check if rcu_dereference_sk_user_data() is NULL after skb_gro_remcsum_init().
AnalysisAI
Denial of service in the Linux kernel's VXLAN driver stems from a race condition in vxlan_gro_prepare_receive(): udp_tunnel_sock_release() can set sk->sk_user_data to NULL while GRO processing is mid-flight, producing a NULL-pointer dereference and kernel panic. It affects hosts using VXLAN overlay tunnels across numerous stable branches, is fixed upstream, and has no public exploit identified at time of analysis (EPSS 0.17%). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the host to have VXLAN tunnels configured and actively receiving traffic, plus a concurrent teardown of the UDP tunnel socket (udp_tunnel_sock_release) occurring during GRO processing in vxlan_gro_prepare_receive() - this narrow timing window is the core prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is materially lower than the headline CVSS 9.8 suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a hypervisor or container host using VXLAN overlays, an administrator or automation tears down a VXLAN tunnel (udp_tunnel_sock_release) at the same moment inbound tunnel packets are being coalesced by GRO; the receive path dereferences the now-NULL sk_user_data and the kernel panics, dropping the node. No public exploit is identified, and the timing-dependent, race-based nature makes deliberate remote triggering unreliable. |
| Remediation | Apply your distribution's kernel update that incorporates the fix - Vendor-released patch: upgrade to Linux 6.1.178, 6.6.145, 6.12.97, or 6.18.40 (or 7.1.5 / 7.2-rc1) or later, matching your kernel series, and reboot. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems and infrastructure components using VXLAN-based networking (hypervisors, container orchestration platforms, network appliances, SDN controllers). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today