{"id":"CVE-2026-97965","summary":"vxlan: initialize _md in vxlan_xmit_one()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: initialize _md in vxlan_xmit_one()\n\nIf a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and\nVXLAN_F_GBP, and a packet is transmitted through it using an external\nip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left\npointing to the uninitialized _md stack variable:\n\n                if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info-\u003ekey.tun_flags)) {\n                        if (info-\u003eoptions_len \u003c sizeof(*md))\n                                goto drop;\n                        md = ip_tunnel_info_opts(info);\n                }\n\nBecause IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains\npointing to _md. Later, vxlan_build_skb() is called with md, which\neventually calls vxlan_build_gbp_hdr():\n\n        if (vxflags & VXLAN_F_GBP)\n                vxlan_build_gbp_hdr(vxh, md);\n\nInside vxlan_build_gbp_hdr(), md-\u003egbp is read:\n\n        if (!md-\u003egbp)\n                return;\n        gbp = (struct vxlanhdr_gbp *)vxh;\n        ...\n        if (md-\u003egbp & VXLAN_GBP_DONT_LEARN)\n                gbp-\u003edont_learn = 1;\n\nIf the stack contains garbage, this causes:\n1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header.\n2) gbp-\u003edont_learn and gbp-\u003epolicy_applied to be set from stack bits.\n3) gbp-\u003epolicy_id to receive 16 bits of uninitialized kernel stack data,\n   leaking it onto the wire.\n\nFix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not\npresent, md-\u003egbp remains 0, and vxlan_build_gbp_hdr() returns early\nwithout modifying the VXLAN header.","modified":"2026-09-26T03:48:27.934359709Z","published":"2026-09-25T10:23:07.952Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97965.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/081f22177d9d12b1e381b787f203cd5f47508187"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0d13b5a413bffc8718b3821b78537ccc6596c233"},{"type":"WEB","url":"https://git.kernel.org/stable/c/be83178bfc44588f6e3adb827ed874c683193466"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bfb74c48ac2d31476d5e09cf9658844508d2608a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97965.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97965"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ee122c79d4227f6ec642157834b6a90fcffa4382"},{"fixed":"0d13b5a413bffc8718b3821b78537ccc6596c233"},{"fixed":"bfb74c48ac2d31476d5e09cf9658844508d2608a"},{"fixed":"081f22177d9d12b1e381b787f203cd5f47508187"},{"fixed":"be83178bfc44588f6e3adb827ed874c683193466"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97965.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97965.json"}}],"schema_version":"1.9.0"}