SB2026092870 - Use-after-free in Linux kernel selftests net

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98122)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a use-after-free in vxlan_mdb_remote_src_del() when processing VXLAN MDB updates containing an all-zeros source address. A local user can submit crafted VXLAN MDB entries to compromise confidentiality, integrity, and availability.

MDB operations are network-namespace scoped and can be performed in a new user and network namespace.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4aa61c88b4e292e10abdfd791334b8272108d68a
• https://git.kernel.org/stable/c/71203a41d6fa2fa0ea2f3a7541987958bd3694fd
• https://git.kernel.org/stable/c/74e2a56c82209b0335b53e25f19f9b0590e2483d
• https://git.kernel.org/stable/c/e12c903fd13c6261b98ca18d8f70ac26e739e2f8