CVE-2026-31738

The vulnerability resides in the Linux kernel's VXLAN module, specifically in the function vxlan_na_create(). This function processes Neighbor Discovery (ND) options and advances a parser based on option-provided lengths. Due to insufficient validation, a malformed ND option can cause the parser to advance beyond the computed option span or use a too-short source LLADDR option payload, leading to an out-of-bounds read [1].

An attacker can trigger the vulnerability by sending a specially crafted VXLAN packet to a target system. No authentication is required if the system is listening on a VXLAN interface. The malformed ND option manipulates the length field to cause the parser to read beyond the intended buffer boundaries, potentially accessing kernel memory that should be inaccessible [2].

The impact is limited to an out-of-bounds read, which could leak sensitive kernel memory contents. This information disclosure could aid an attacker in bypassing security mechanisms like KASLR. The CVSS v3 score of 5.5 (Medium) reflects the need for network access and the likelihood of some information disclosure, but not arbitrary control [3].

The fix is available in stable kernel commits that add proper validation of ND option lengths before advancing the parser, ensuring the source LLADDR is only read when the option is sufficiently large for an Ethernet address [4]. Systems should apply these patches from the respective stable kernels to mitigate the vulnerability.