CVE-2026-97965

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97965", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.206Z", "datePublished": "2026-09-25T10:23:07.952Z", "dateUpdated": "2026-10-21T12:53:54.233Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:54.233Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: initialize _md in vxlan_xmit_one()\n\nIf a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and\nVXLAN_F_GBP, and a packet is transmitted through it using an external\nip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left\npointing to the uninitialized _md stack variable:\n\n if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {\n if (info->options_len < sizeof(*md))\n goto drop;\n md = ip_tunnel_info_opts(info);\n }\n\nBecause IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains\npointing to _md. Later, vxlan_build_skb() is called with md, which\neventually calls vxlan_build_gbp_hdr():\n\n if (vxflags & VXLAN_F_GBP)\n vxlan_build_gbp_hdr(vxh, md);\n\nInside vxlan_build_gbp_hdr(), md->gbp is read:\n\n if (!md->gbp)\n return;\n gbp = (struct vxlanhdr_gbp *)vxh;\n ...\n if (md->gbp & VXLAN_GBP_DONT_LEARN)\n gbp->dont_learn = 1;\n\nIf the stack contains garbage, this causes:\n1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header.\n2) gbp->dont_learn and gbp->policy_applied to be set from stack bits.\n3) gbp->policy_id to receive 16 bits of uninitialized kernel stack data,\n leaking it onto the wire.\n\nFix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not\npresent, md->gbp remains 0, and vxlan_build_gbp_hdr() returns early\nwithout modifying the VXLAN header."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "versions": [{"version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "lessThan": "fb78beb64e0e79557e4cd7cd17fea744bb6f01d9", "status": "affected", "versionType": "git"}, {"version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "lessThan": "0d13b5a413bffc8718b3821b78537ccc6596c233", "status": "affected", "versionType": "git"}, {"version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "lessThan": "bfb74c48ac2d31476d5e09cf9658844508d2608a", "status": "affected", "versionType": "git"}, {"version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "lessThan": "081f22177d9d12b1e381b787f203cd5f47508187", "status": "affected", "versionType": "git"}, {"version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "lessThan": "be83178bfc44588f6e3adb827ed874c683193466", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "versions": [{"version": "4.3", "status": "affected"}, {"version": "0", "lessThan": "4.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fb78beb64e0e79557e4cd7cd17fea744bb6f01d9"}, {"url": "https://git.kernel.org/stable/c/0d13b5a413bffc8718b3821b78537ccc6596c233"}, {"url": "https://git.kernel.org/stable/c/bfb74c48ac2d31476d5e09cf9658844508d2608a"}, {"url": "https://git.kernel.org/stable/c/081f22177d9d12b1e381b787f203cd5f47508187"}, {"url": "https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466"}], "title": "vxlan: initialize _md in vxlan_xmit_one()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fb78beb64e0e79557e4cd7cd17fea744bb6f01d9", "status": "affected", "version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "versionType": "git"}, {"lessThan": "0d13b5a413bffc8718b3821b78537ccc6596c233", "status": "affected", "version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "versionType": "git"}, {"lessThan": "bfb74c48ac2d31476d5e09cf9658844508d2608a", "status": "affected", "version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "versionType": "git"}, {"lessThan": "081f22177d9d12b1e381b787f203cd5f47508187", "status": "affected", "version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "versionType": "git"}, {"lessThan": "be83178bfc44588f6e3adb827ed874c683193466", "status": "affected", "version": "ee122c79d4227f6ec642157834b6a90fcffa4382", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/vxlan/vxlan_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.3"}, {"lessThan": "4.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: initialize _md in vxlan_xmit_one()\n\nIf a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and\nVXLAN_F_GBP, and a packet is transmitted through it using an external\nip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left\npointing to the uninitialized _md stack variable:\n\n if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {\n if (info->options_len < sizeof(*md))\n goto drop;\n md = ip_tunnel_info_opts(info);\n }\n\nBecause IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains\npointing to _md. Later, vxlan_build_skb() is called with md, which\neventually calls vxlan_build_gbp_hdr():\n\n if (vxflags & VXLAN_F_GBP)\n vxlan_build_gbp_hdr(vxh, md);\n\nInside vxlan_build_gbp_hdr(), md->gbp is read:\n\n if (!md->gbp)\n return;\n gbp = (struct vxlanhdr_gbp *)vxh;\n ...\n if (md->gbp & VXLAN_GBP_DONT_LEARN)\n gbp->dont_learn = 1;\n\nIf the stack contains garbage, this causes:\n1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header.\n2) gbp->dont_learn and gbp->policy_applied to be set from stack bits.\n3) gbp->policy_id to receive 16 bits of uninitialized kernel stack data,\n leaking it onto the wire.\n\nFix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not\npresent, md->gbp remains 0, and vxlan_build_gbp_hdr() returns early\nwithout modifying the VXLAN header."}], "id": "CVE-2026-97965", "lastModified": "2026-10-21T13:21:17.963", "metrics": {}, "published": "2026-09-25T11:17:24.293", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/081f22177d9d12b1e381b787f203cd5f47508187"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0d13b5a413bffc8718b3821b78537ccc6596c233"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bfb74c48ac2d31476d5e09cf9658844508d2608a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb78beb64e0e79557e4cd7cd17fea744bb6f01d9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: vxlan: initialize _md in vxlan_xmit_one()", "id": "2541282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541282"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvxlan: initialize _md in vxlan_xmit_one()\nIf a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and\nVXLAN_F_GBP, and a packet is transmitted through it using an external\nip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left\npointing to the uninitialized _md stack variable:\nif (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {\nif (info->options_len < sizeof(*md))\ngoto drop;\nmd = ip_tunnel_info_opts(info);\n}\nBecause IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains\npointing to _md. Later, vxlan_build_skb() is called with md, which\neventually calls vxlan_build_gbp_hdr():\nif (vxflags & VXLAN_F_GBP)\nvxlan_build_gbp_hdr(vxh, md);\nInside vxlan_build_gbp_hdr(), md->gbp is read:\nif (!md->gbp)\nreturn;\ngbp = (struct vxlanhdr_gbp *)vxh;\n...\nif (md->gbp & VXLAN_GBP_DONT_LEARN)\ngbp->dont_learn = 1;\nIf the stack contains garbage, this causes:\n1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header.\n2) gbp->dont_learn and gbp->policy_applied to be set from stack bits.\n3) gbp->policy_id to receive 16 bits of uninitialized kernel stack data,\nleaking it onto the wire.\nFix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not\npresent, md->gbp remains 0, and vxlan_build_gbp_hdr() returns early\nwithout modifying the VXLAN header.", "A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) driver. When transmitting network packets on devices configured with Group Based Policy (GBP) metadata, the driver fails to properly initialize an internal stack variable if packet flags are omitted. This issue allows residual kernel stack data to be written into outgoing packet headers, resulting in information disclosure across the network."], "name": "CVE-2026-97965", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97965\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97965\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97965.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ee122c79d4227f6ec642157834b6a90fcffa4382,0d13b5a413bffc8718b3821b78537ccc6596c233)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ee122c79d4227f6ec642157834b6a90fcffa4382,bfb74c48ac2d31476d5e09cf9658844508d2608a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ee122c79d4227f6ec642157834b6a90fcffa4382,081f22177d9d12b1e381b787f203cd5f47508187)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ee122c79d4227f6ec642157834b6a90fcffa4382,be83178bfc44588f6e3adb827ed874c683193466)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T17:45:17.373330+00:00", "updated": "2026-10-01T04:45:12.418776+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-788", "CWE-908"]}