CVE-2026-93250

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()

vxlan_mdb_flush() iterates over the MDB entries using

hlist_for_each_entry_safe(), which only tolerates the removal of the

current entry. Contrary to the comment above the loop, the removal of an

entry can trigger the removal of another entry.

Flushing the remotes of a (*, G) entry also removes the (S, G) entries

that were created for its source list, once they are left without

remotes:

vxlan_mdb_remotes_flush()

-> vxlan_mdb_remote_del()

-> vxlan_mdb_remote_srcs_del()

-> vxlan_mdb_remote_src_del()

-> vxlan_mdb_remote_src_fwd_del()

-> __vxlan_mdb_del()

-> vxlan_mdb_entry_put()

Such an entry can be located after the (*, G) entry in the list, as

vxlan_mdb_entry_get() returns an existing entry without moving it to the

head of the list. This order is obtained by adding the (S, G) entry

before the (*, G) entry, the latter wi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References