CVE-2026-89776

CVE CVE-2026-89776EUVD EUVD-2026-80297Published 2026-09-16T08:48:17.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory. Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <47bfcc871576eaef6c8edab6749acd4b317306ea; patch: 6.18.52; patch: 7.3-rc1; f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <ad32e564c62ebf5ba76dd60a22af52c69d54d17b; patch: 6.6.157; 5.18; f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <a9ec10815199f9879ba080241dc555efb1daf324; f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <e12c4663529699f457b2988c1dfedf4d13b3b3be; f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <daebc7064a1b4c12c98e52c4bceede7f2fcd573c; patch: 6.12.110; patch: 7.2.6; f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <984f831dda31b3a18f47454cf64989f65402879e; patch: 0; patch: 6.1.188

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.