---
id: CVE-2026-98568
title: 'vxlan: use one headroom snapshot for neighbour replies'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vxlan: use one headroom snapshot for neighbour replies

  vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
  samples it again to reserve headroo…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa <
    45a67662bf8ce3aa5643accf98d328dfbb47eaf6
  - >-
    Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa <
    315d42ca39f69846662961c25dcf2bb07c350d14
  - >-
    Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa <
    a3c5eb6e382dd426a5e7eb08608897ed57167ff7
  - >-
    Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa <
    ff022fd9d0f0282c575e11778b96bd1b637503eb
  - >-
    Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa <
    481506a756dcd828ef42391cb08f38d8d96d38fc
  - Linux d8be18c52dbc94989f6d74637b731af39cd3d902
  - Linux 3927dace523706cc00f808520eaf2125dd7c07b5
  - Linux >= 3.12.18 < 3.13
  - Linux >= 3.13.10 < 3.14
  - Linux 3.14
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:18:34.562Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98568'
references:
  - url: 'https://git.kernel.org/stable/c/45a67662bf8ce3aa5643accf98d328dfbb47eaf6'
  - url: 'https://git.kernel.org/stable/c/315d42ca39f69846662961c25dcf2bb07c350d14'
  - url: 'https://git.kernel.org/stable/c/a3c5eb6e382dd426a5e7eb08608897ed57167ff7'
  - url: 'https://git.kernel.org/stable/c/ff022fd9d0f0282c575e11778b96bd1b637503eb'
  - url: 'https://git.kernel.org/stable/c/481506a756dcd828ef42391cb08f38d8d96d38fc'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.261Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use one headroom snapshot for neighbour replies

vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then
samples it again to reserve headroom. A concurrent vxlan_changelink() can
update needed_headroom between the two reads, creating a TOCTOU race. The
second value can exceed the allocation and make the Ethernet header write out
of bounds.

The race is reproducible on the unpatched kernel. It occurred when
vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed
the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte
skbuff_small_head allocation.

Snapshot the headroom once and use that value for both allocation and
reservation.

## Affected

- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 45a67662bf8ce3aa5643accf98d328dfbb47eaf6`
- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 315d42ca39f69846662961c25dcf2bb07c350d14`
- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < a3c5eb6e382dd426a5e7eb08608897ed57167ff7`
- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < ff022fd9d0f0282c575e11778b96bd1b637503eb`
- `Linux >= 4b29dba9c085a4fb79058fb1c45a2f6257ca3dfa < 481506a756dcd828ef42391cb08f38d8d96d38fc`
- `Linux d8be18c52dbc94989f6d74637b731af39cd3d902`
- `Linux 3927dace523706cc00f808520eaf2125dd7c07b5`
- `Linux >= 3.12.18 < 3.13`
- `Linux >= 3.13.10 < 3.14`
- `Linux 3.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.