CVE-2026-98122 (GCVE-0-2026-98122)
Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-10-19 09:14
VLAI
EPSS
VEX
Title
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every
MDBE_ATTR_SRC_LIST member, accepts the all-zeros address.
A source list is only accepted on a (*, G) entry, whose source is the
all-zeros address, and for each member of the list an (S, G) entry is
derived from it by substituting the source. Entries are keyed by a plain
memcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present
and holds the all-zeros address and the source list holds it as well, the
derived (S, G) key is byte-identical to the (*, G) key and resolves to the
same entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is
then left with a zero address family.
vxlan_mdb_remote_src_del() removes the forwarding entry of a source before
freeing the source entry:
vxlan_mdb_remote_src_fwd_del(vxlan, group, remote, &ent->addr);
vxlan_mdb_remote_src_entry_del(ent);
With the keys aliased, the first call deletes the remote of the entry that
owns 'ent' instead of a separate (S, G) entry, and frees 'ent'. The second
call then runs on the freed entry, and its hlist_del() reads ->pprev and
->next out of it and writes through them.
Adding the (*, G) entry with NLM_F_REPLACE and no source list marks the
all-zeros source for deletion and reaches this from the sweep at the end
of vxlan_mdb_remote_srcs_replace().
BUG: KASAN: slab-use-after-free in __vxlan_mdb_add+0x1cd/0xd70
Read of size 8 at addr ffff888102852500 by task poc/84
__vxlan_mdb_add+0x1cd/0xd70
vxlan_mdb_add+0xc0/0x140
rtnl_mdb_add+0x157/0x2a0
rtnetlink_rcv_msg+0x207/0x5a0
Allocated by task 84:
__kmalloc_cache_noprof+0x153/0x360
vxlan_mdb_remote_srcs_add+0x2eb/0x440
__vxlan_mdb_add+0x803/0xd70
Freed by task 84:
kfree+0x14c/0x3b0
vxlan_mdb_remote_del+0x129/0x1a0
__vxlan_mdb_del+0x4f/0xe0
vxlan_mdb_remote_src_fwd_del.isra.0+0x162/0x1b0
__vxlan_mdb_add+0x1c5/0xd70
The MDB operations are netns-scoped, so an unprivileged user can perform
them in a new user and network namespace.
Reject the all-zeros address in vxlan_mdb_is_valid_source(), which covers
both call sites. A (*, G) entry is expressed by omitting the source, so
nothing legitimate is refused.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
a3a48de5eade770e911d35291217bdd69ce04ef1 , < 069d5527bb0f229e528fa88c6b72f15060c373f2
(git)
Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < e12c903fd13c6261b98ca18d8f70ac26e739e2f8 (git) Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < 74e2a56c82209b0335b53e25f19f9b0590e2483d (git) Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < 71203a41d6fa2fa0ea2f3a7541987958bd3694fd (git) Affected: a3a48de5eade770e911d35291217bdd69ce04ef1 , < 4aa61c88b4e292e10abdfd791334b8272108d68a (git) |
guessed | |
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2.7 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_mdb.c",
"tools/testing/selftests/net/test_vxlan_mdb.sh"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "069d5527bb0f229e528fa88c6b72f15060c373f2",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
},
{
"lessThan": "e12c903fd13c6261b98ca18d8f70ac26e739e2f8",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
},
{
"lessThan": "74e2a56c82209b0335b53e25f19f9b0590e2483d",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
},
{
"lessThan": "71203a41d6fa2fa0ea2f3a7541987958bd3694fd",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
},
{
"lessThan": "4aa61c88b4e292e10abdfd791334b8272108d68a",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_mdb.c",
"tools/testing/selftests/net/test_vxlan_mdb.sh"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()\n\nvxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every\nMDBE_ATTR_SRC_LIST member, accepts the all-zeros address.\n\nA source list is only accepted on a (*, G) entry, whose source is the\nall-zeros address, and for each member of the list an (S, G) entry is\nderived from it by substituting the source. Entries are keyed by a plain\nmemcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present\nand holds the all-zeros address and the source list holds it as well, the\nderived (S, G) key is byte-identical to the (*, G) key and resolves to the\nsame entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is\nthen left with a zero address family.\n\nvxlan_mdb_remote_src_del() removes the forwarding entry of a source before\nfreeing the source entry:\n\n\tvxlan_mdb_remote_src_fwd_del(vxlan, group, remote, \u0026ent-\u003eaddr);\n\tvxlan_mdb_remote_src_entry_del(ent);\n\nWith the keys aliased, the first call deletes the remote of the entry that\nowns \u0027ent\u0027 instead of a separate (S, G) entry, and frees \u0027ent\u0027. The second\ncall then runs on the freed entry, and its hlist_del() reads -\u003epprev and\n-\u003enext out of it and writes through them.\n\nAdding the (*, G) entry with NLM_F_REPLACE and no source list marks the\nall-zeros source for deletion and reaches this from the sweep at the end\nof vxlan_mdb_remote_srcs_replace().\n\n BUG: KASAN: slab-use-after-free in __vxlan_mdb_add+0x1cd/0xd70\n Read of size 8 at addr ffff888102852500 by task poc/84\n __vxlan_mdb_add+0x1cd/0xd70\n vxlan_mdb_add+0xc0/0x140\n rtnl_mdb_add+0x157/0x2a0\n rtnetlink_rcv_msg+0x207/0x5a0\n Allocated by task 84:\n __kmalloc_cache_noprof+0x153/0x360\n vxlan_mdb_remote_srcs_add+0x2eb/0x440\n __vxlan_mdb_add+0x803/0xd70\n Freed by task 84:\n kfree+0x14c/0x3b0\n vxlan_mdb_remote_del+0x129/0x1a0\n __vxlan_mdb_del+0x4f/0xe0\n vxlan_mdb_remote_src_fwd_del.isra.0+0x162/0x1b0\n __vxlan_mdb_add+0x1c5/0xd70\n\nThe MDB operations are netns-scoped, so an unprivileged user can perform\nthem in a new user and network namespace.\n\nReject the all-zeros address in vxlan_mdb_is_valid_source(), which covers\nboth call sites. A (*, G) entry is expressed by omitting the source, so\nnothing legitimate is refused.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The malformed input is an RTM_NEWMDB rtnetlink message sent from a local socket (rtnl_mdb_add -\u003e vxlan_mdb_add -\u003e __vxlan_mdb_add -\u003e vxlan_mdb_remote_srcs_replace -\u003e vxlan_mdb_remote_src_del); no packet received from the network reaches the MDB control path.\nAC:L - It is deterministic, with no race: add a (*, G) entry with MDBE_ATTR_SOURCE 0.0.0.0 and 0.0.0.0 in MDBE_ATTR_SRC_LIST, then re-add it with NLM_F_REPLACE and no source list. The attacker creates every piece of the required state.\nPR:L - The only check is netlink_net_capable(CAP_NET_ADMIN) in rtnetlink_rcv_msg, which is namespace-scoped. An unprivileged user can get it with unshare -Urn, create their own vxlan device and send RTM_NEWMDB to it.\nUI:N - The attacker\u0027s own netlink messages, on a vxlan device they created in their own namespace, trigger the bug; no other user has to do anything.\nS:U - Corrupting kernel heap memory gives kernel-level impact within the same security authority, which is ordinary local privilege escalation with no VM or hardware boundary crossed.\nC:H - A heap spray can reclaim the freed vxlan_mdb_src_entry before vxlan_mdb_remote_src_entry_del reads it, so the attacker controls the pointers the kernel then uses. This is a slab use-after-free that can be built into a kernel memory disclosure.\nI:H - hlist_del() in vxlan_mdb_remote_src_entry_del reads -\u003enext and -\u003epprev from the freed entry and writes through them. Once the slot is reclaimed with controlled data, that is an attacker-directed pointer write (an unlink write primitive).\nA:H - Unlinking a freed hlist node corrupts kernel memory; KASAN reports it in __vxlan_mdb_add, and without KASAN the corrupted list pointers can oops or panic the kernel. Any user who can open a user namespace can trigger it repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:14:14.316Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/069d5527bb0f229e528fa88c6b72f15060c373f2"
},
{
"url": "https://git.kernel.org/stable/c/e12c903fd13c6261b98ca18d8f70ac26e739e2f8"
},
{
"url": "https://git.kernel.org/stable/c/74e2a56c82209b0335b53e25f19f9b0590e2483d"
},
{
"url": "https://git.kernel.org/stable/c/71203a41d6fa2fa0ea2f3a7541987958bd3694fd"
},
{
"url": "https://git.kernel.org/stable/c/4aa61c88b4e292e10abdfd791334b8272108d68a"
}
],
"title": "vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98122",
"datePublished": "2026-09-25T10:36:05.369Z",
"dateReserved": "2026-09-25T10:25:14.318Z",
"dateUpdated": "2026-10-19T09:14:14.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-98122",
"date": "2026-11-13",
"epss": "0.00125",
"percentile": "0.02249"
},
"microsoft_vex": {
"current_release_date": "2026-10-21T18:40:40.000Z",
"cve": "CVE-2026-98122",
"id": "msrc_CVE-2026-98122",
"initial_release_date": "2026-09-28T00:36:06.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"product_status:under_investigation": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98122.json",
"version": "4"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_mdb.c",
"tools/testing/selftests/net/test_vxlan_mdb.sh"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "069d5527bb0f229e528fa88c6b72f15060c373f2",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
},
{
"lessThan": "e12c903fd13c6261b98ca18d8f70ac26e739e2f8",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
},
{
"lessThan": "74e2a56c82209b0335b53e25f19f9b0590e2483d",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
},
{
"lessThan": "71203a41d6fa2fa0ea2f3a7541987958bd3694fd",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
},
{
"lessThan": "4aa61c88b4e292e10abdfd791334b8272108d68a",
"status": "affected",
"version": "a3a48de5eade770e911d35291217bdd69ce04ef1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_mdb.c",
"tools/testing/selftests/net/test_vxlan_mdb.sh"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0E70134D-9B4B-43A0-B5C8-9DCEDD74AB69",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "47BC31C9-3D9E-4B96-B5F8-291D6AD55D81",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7561AABB-6D5A-4324-BC66-C6C6B012AFD8",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "19917B2D-B4B2-4416-A482-9C7C4929A921",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "11E35E1B-5DB4-4AB9-9706-CD73B799EADF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()\n\nvxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every\nMDBE_ATTR_SRC_LIST member, accepts the all-zeros address.\n\nA source list is only accepted on a (*, G) entry, whose source is the\nall-zeros address, and for each member of the list an (S, G) entry is\nderived from it by substituting the source. Entries are keyed by a plain\nmemcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present\nand holds the all-zeros address and the source list holds it as well, the\nderived (S, G) key is byte-identical to the (*, G) key and resolves to the\nsame entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is\nthen left with a zero address family.\n\nvxlan_mdb_remote_src_del() removes the forwarding entry of a source before\nfreeing the source entry:\n\n\tvxlan_mdb_remote_src_fwd_del(vxlan, group, remote, \u0026ent-\u003eaddr);\n\tvxlan_mdb_remote_src_entry_del(ent);\n\nWith the keys aliased, the first call deletes the remote of the entry that\nowns \u0027ent\u0027 instead of a separate (S, G) entry, and frees \u0027ent\u0027. The second\ncall then runs on the freed entry, and its hlist_del() reads -\u003epprev and\n-\u003enext out of it and writes through them.\n\nAdding the (*, G) entry with NLM_F_REPLACE and no source list marks the\nall-zeros source for deletion and reaches this from the sweep at the end\nof vxlan_mdb_remote_srcs_replace().\n\n BUG: KASAN: slab-use-after-free in __vxlan_mdb_add+0x1cd/0xd70\n Read of size 8 at addr ffff888102852500 by task poc/84\n __vxlan_mdb_add+0x1cd/0xd70\n vxlan_mdb_add+0xc0/0x140\n rtnl_mdb_add+0x157/0x2a0\n rtnetlink_rcv_msg+0x207/0x5a0\n Allocated by task 84:\n __kmalloc_cache_noprof+0x153/0x360\n vxlan_mdb_remote_srcs_add+0x2eb/0x440\n __vxlan_mdb_add+0x803/0xd70\n Freed by task 84:\n kfree+0x14c/0x3b0\n vxlan_mdb_remote_del+0x129/0x1a0\n __vxlan_mdb_del+0x4f/0xe0\n vxlan_mdb_remote_src_fwd_del.isra.0+0x162/0x1b0\n __vxlan_mdb_add+0x1c5/0xd70\n\nThe MDB operations are netns-scoped, so an unprivileged user can perform\nthem in a new user and network namespace.\n\nReject the all-zeros address in vxlan_mdb_is_valid_source(), which covers\nboth call sites. A (*, G) entry is expressed by omitting the source, so\nnothing legitimate is refused.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
}
],
"id": "CVE-2026-98122",
"lastModified": "2026-10-22T17:19:22.093",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-09-25T11:17:43.470",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/069d5527bb0f229e528fa88c6b72f15060c373f2"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/4aa61c88b4e292e10abdfd791334b8272108d68a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/71203a41d6fa2fa0ea2f3a7541987958bd3694fd"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/74e2a56c82209b0335b53e25f19f9b0590e2483d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/e12c903fd13c6261b98ca18d8f70ac26e739e2f8"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-11-06T02:48:31+00:00",
"cve": "CVE-2026-98122",
"id": "CVE-2026-98122",
"initial_release_date": "2026-09-25T00:00:00+00:00",
"product_status:known_affected": "110",
"product_status:known_not_affected": "93",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98122.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.