CVE-2026-98568

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use one headroom snapshot for neighbour replies

vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then

samples it again to reserve headroom. A concurrent vxlan_changelink() can

update needed_headroom between the two reads, creating a TOCTOU race. The

second value can exceed the allocation and make the Ethernet header write out

of bounds.

The race is reproducible on the unpatched kernel. It occurred when

vxlan_na_create() generated a neighbour reply while vxlan_changelink() changed

the link headroom. KASAN caught a four-byte write two bytes beyond a 704-byte

skbuff_small_head allocation.

Snapshot the headroom once and use that value for both allocation and

reservation.