In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
udp_tunnel_sock_release() could set sk->sk_user_data to NULL
while vxlan_gro_prepare_receive() is running.
Let's check if rcu_dereference_sk_user_data() is NULL after
skb_gro_remcsum_init().
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The bug is in vxlan_gro_prepare_receive() on the UDP GRO receive path; remote VXLAN/UDP packets reach it via inet_gro_receive→udp4_gro_receive→udp_tunnel_gro_rcv→vxlan_gro_receive during NAPI processing on internet/cloud overlay endpoints.
AC:L - An attacker can reliably trigger the race by flooding VXLAN GRO packets while concurrently tearing down the VXLAN device (e.g., via CAP_NET_ADMIN in a user namespace); repeated attempts during orchestrated interface churn also make the timing window attacker-driven rather than purely environmental.
PR:N - Exploitation requires only the ability to send crafted VXLAN UDP traffic to a listening tunnel port; no target credentials or local account are needed, and concurrent teardown can occur from normal administrative or automation activity rather than attacker-held privileges.
UI:N - No victim interaction is required beyond the host already running a VXLAN interface; the attacker triggers the fault purely by sending network packets timed against interface teardown.
S:U - Impact is a kernel fault in networking softirq context on the same host; it does not cross VM, container, or IOMMU security boundaries into another authority.
C:H - The race can leave a stale vxlan_sock pointer after udp_tunnel_sock_release() frees sk_user_data; dereferencing vs->flags is a use-after-free read that can expose kernel heap contents and is treated as arbitrary read potential under conservative scoring.
I:H - Use-after-free on the vxlan_sock object during GRO teardown can corrupt heap metadata or adjacent objects and be leveraged for control-flow hijacking, not merely a benign NULL check failure.
A:H - A successful trigger causes a kernel NULL pointer dereference/oops in NAPI/softirq context (documented crash at vxlan_gro_prepare_receive), typically crashing or hanging the host and denying all services.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The bug is in vxlan_gro_prepare_receive() on the UDP GRO receive path; remote VXLAN/UDP packets reach it via inet_gro_receive→udp4_gro_receive→udp_tunnel_gro_rcv→vxlan_gro_receive during NAPI processing on internet/cloud overlay endpoints.
AC:L - An attacker can reliably trigger the race by flooding VXLAN GRO packets while concurrently tearing down the VXLAN device (e.g., via CAP_NET_ADMIN in a user namespace); repeated attempts during orchestrated interface churn also make the timing window attacker-driven rather than purely environmental.
PR:N - Exploitation requires only the ability to send crafted VXLAN UDP traffic to a listening tunnel port; no target credentials or local account are needed, and concurrent teardown can occur from normal administrative or automation activity rather than attacker-held privileges.
UI:N - No victim interaction is required beyond the host already running a VXLAN interface; the attacker triggers the fault purely by sending network packets timed against interface teardown.
S:U - Impact is a kernel fault in networking softirq context on the same host; it does not cross VM, container, or IOMMU security boundaries into another authority.
C:H - The race can leave a stale vxlan_sock pointer after udp_tunnel_sock_release() frees sk_user_data; dereferencing vs->flags is a use-after-free read that can expose kernel heap contents and is treated as arbitrary read potential under conservative scoring.
I:H - Use-after-free on the vxlan_sock object during GRO teardown can corrupt heap metadata or adjacent objects and be leveraged for control-flow hijacking, not merely a benign NULL check failure.
A:H - A successful trigger causes a kernel NULL pointer dereference/oops in NAPI/softirq context (documented crash at vxlan_gro_prepare_receive), typically crashing or hanging the host and denying all services.
CVSS 3.1