CVE-2026-98122 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users with unprivileged access to systems using the Linux kernel should assess exposure and prioritize verification and patching.

Why it matters

A use-after-free vulnerability in the Linux kernel's vxlan_mdb_remote_src_del function can be exploited by unprivileged users with access to new user and network namespaces, potentially leading to denial of service or privilege escalation.

• Unprivileged users can perform MDB operations in a new user and network namespace, potentially leading to use-after-free errors.
• Successful exploitation could result in denial of service or potential elevation of privileges.
• Verification of affected systems and patching or mitigation is necessary to prevent potential exploitation.
• Exposure assessment and monitoring for potential exploitation attempts are recommended.

Technical summary

The vxlan_mdb_remote_src_del function removes the forwarding entry of a source before freeing the source entry. With the keys aliased, the first call deletes the remote of the entry that owns 'ent' instead of a separate (S, G) entry, and frees 'ent'. The second call then runs on the freed entry, and its hlist_del() reads ->pprev and ->next out of it and writes through them. This issue is resolved by rejecting the all-zeros address in vxlan_mdb_is_valid_source, covering both call sites. A (*, G) entry is expressed by omitting the source, so nothing legitimate is refused. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those with unprivileged

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those with unprivileged user access to new user and network namespaces.

Recommended defensive actions

• Assess exposure of Linux kernel systems to unprivileged user access in new user and network namespaces
• Verify affected systems and prioritize patching or mitigation
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability was discovered by XBOW and triaged by Baul Lee. The issue is resolved by rejecting the all-zeros address in vxlan_mdb_is_valid_source, covering both call sites. A (*, G) entry is expressed by omitting the source, so nothing legitimate is refused.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.