CVE-2026-97965 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using VXLAN devices, should assess exposure and verify configuration to prevent potential data leakage. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review the configuration of VXLAN devices, ensure proper setting of ip_tunnel_info, and apply kernel updates as needed. Prioritization is crucial for systems with high-

Why it matters

Defenders should prioritize verifying the configuration of VXLAN devices and ensuring that ip_tunnel_info is properly set to prevent potential data leakage.

• Potential data leakage of 16 bits of uninitialized kernel stack data onto the wire.
• Spurious setting of VXLAN_HF_GBP flag in the VXLAN header.
• Improper setting of gbp->dont_learn and gbp->policy_applied from stack bits.

Technical summary

The vulnerability is caused by the uninitialized _md stack variable in vxlan_xmit_one(). When IP_TUNNEL_VXLAN_OPT_BIT is not set, md points to _md, leading to potential data leakage and spurious setting of the VXLAN_HF_GBP flag in the VXLAN header. The fix involves initializing _md to prevent data leakage and incorrect flag setting. Affected systems include Linux kernel-based systems using VXLAN devices with specific configurations. Defenders should prioritize verifying configuration and applying kernel updates. Technical details are grounded in public CVE information and supplied advisories.

Defensive priority

Defenders should prioritize verifying the configuration of VXLAN devices and ensuring that ip_tunnel_info is properly set to prevent potential data leakage.

Recommended defensive actions

• Verify the configuration of VXLAN devices to ensure that ip_tunnel_info is properly set.
• Check for and apply kernel updates that include the fix for this vulnerability.
• Monitor network traffic for potential data leakage.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The vulnerability was resolved by initializing _md in vxlan_xmit_one(). The issue arises when IP_TUNNEL_VXLAN_OPT_BIT is not set, causing md to point to the uninitialized _md stack variable. Defenders should verify the configuration of VXLAN devices and ensure that ip_tunnel_info is properly set to prevent potential data leakage. Evidence is limited to public CVE details and supplied advisory text.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.