SB20260928183 - Use-after-free in Linux kernel selftests net

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98023)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to use-after-free in the VXLAN forwarding database entry handling when configuring dynamic FDB entries that reference an FDB nexthop. A local user can configure dynamic entries on VXLAN devices that share an FDB nexthop to cause memory corruption.

The race can occur when an entry is aged while another device adds or deletes an entry associated with the shared FDB nexthop.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/28f86eec851b7406a4bc6143f82aeba2882d9842
• https://git.kernel.org/stable/c/3fa64d86fc64eda104e3e97721a12a42a2fd2073
• https://git.kernel.org/stable/c/53359916ceb649b7e6947c8c2f669368a41c1354
• https://git.kernel.org/stable/c/98fc57d167446b95b4e719815fe79edef93f8e7a