CVE-2026-97965
Description
A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) driver. When transmitting network packets on devices configured with Group Based Policy (GBP) metadata, the driver fails to properly initialize an internal stack variable if packet flags are omitted. This issue allows residual kernel stack data to be written into outgoing packet headers, resulting in information disclosure across the network.
Statement
An uninitialized stack vxlan_metadata structure can be used when a VXLAN device enables both collect metadata and GBP, but the external ip_tunnel_info does not include the VXLAN option flag. A packet sent through the affected VXLAN egress path can then carry stack derived bits in the GBP header, including a 16 bit policy_id field. This is network reachable only in deployments using this specific flow based VXLAN configuration. For the CVSS the PR:N value reflects that an attacker may only need to send traffic through an already configured affected VXLAN forwarding path and does not necessarily need local access to the host. The confirmed impact is limited kernel stack information disclosure. The paranoid score also assigns limited integrity impact because corrupted GBP flags or policy metadata may affect handling at the remote VXLAN endpoint. No memory corruption, privilege escalation, or denial of service primitive is demonstrated by the patch.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
