CVE-2026-89776

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address

attributes as NLA_BINARY with only a maximum length, so validate_nla()

accepts a payload shorter than the address. The GROUP consumer reads it

with nla_get_in_addr(), an unconditional 4-byte load, so a short

attribute over-reads up to 3 bytes of uninitialised slab data, which are

stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing

kernel memory.

Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects

any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is

always sent at full width.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References