In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan_na_create() samples… (CVE-2026-98568)

The Linux kernel VXLAN module had a TOCTOU race condition in vxlan_na_create() where the function sampled LL_RESERVED_SPACE() twice to size and reserve headroom for neighbour replies. A concurrent vxlan_changelink() could update needed_headroom between these reads, causing the second sampled value to exceed the allocated buffer size. This led to an out-of-bounds write of the Ethernet header. The race was reproducible and detected by KASAN. The fix involves taking a single snapshot of the headroom value and using it consistently for allocation and reservation to prevent the race.

This vulnerability can cause out-of-bounds memory writes in the kernel, which may lead to memory corruption, system instability, or potential escalation of privileges if exploited. However, there is no indication of known exploits in the wild. The issue affects the integrity and stability of the Linux kernel networking stack.

A fix has been implemented in the Linux kernel to address this vulnerability by snapshotting the headroom once and using that value consistently. Users should update to the patched kernel version containing this fix. Since no specific patch links or vendor advisories are provided, users should consult their Linux distribution's security updates for the official fix.