CVE-2026-89776

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the VXLAN VNI filter entry policy where GROUP and GROUP6 address attributes are declared as NLA BINARY with only a maximum length. This allows the validate nla() function to accept payloads shorter than the required address length. When the GROUP consumer processes this using nla get in addr(), it performs an unconditional 4-byte load, leading to an over-read of up to 3 bytes of uninitialized slab data. This data is stored in remote ip and can be disclosed via RTM GETTUNNEL, resulting in the exposure of kernel memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.