UBUNTU-CVE-2026-115538

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN...

CVE-2026-115538

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped CVE-2026-72434 In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. CVE-2026-74406 I...

kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

CVE-2026-115538

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN...

CVE-2026-115538 Docker Engine overlay-network encryption rules are not restored after a firewalld reload

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN...

CVE-2026-115538

Moby's overlay network driver fails to restore iptables rules for encrypted overlay networks after they are deleted by firewalld . Unlike other Docker Engine networking components, this driver does not handle firewalld reload or start signals over D-Bus . This failure causes outgoing VXLAN datagr...

CVE-2026-115538

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN...

CVE-2026-115538

Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLABINARY with only a maximum length, so validatenla accepts a payload shorter th...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmitting network layer headers In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB key...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic FDB entries that reference a nexthop id The commit referenced in the Fixes tag allows VXLAN FDB entries to point to FDB nexthops, enabling overlay traffic to be load balanced across multiple VTEPs. Such...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: vxlan: prevent NULL deref in vxlanxmitone Neither sock4 nor sock6 pointers are guaranteed to be non-NULL in vxlanxmitone, for example when the interface is down. This can result in the following NULL dereference: BUG: kernel...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit Currently, routeshortcircuit calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks whether bytes are available starting from skb-data. However, in vxlanxmit, skb-data...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fixed potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease may set sk-skuserdata to NULL while vxlangropreparereceive is executing. Let’s verify whether rcudereferenceskuserdata returns NULL after...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neighhasnapshot in routeshortcircuit The neighbor hardware address n-ha can be updated asynchronously by the neighbor subsystem, protected by n-halock seqlock. Reading n-ha without holding the seqlock loop can lead to...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: vxlan: requires CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns: devnetdev and the sticky underlay netns vxlan-net. They differ once the device is created in or moved to a netns...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: vxlan: re-fetch eth header after routeshortcircuit Before routeshortcircuit, the eth header pointer is cached from ethhdrskb. Inside routeshortcircuit, pskbmaypull can be called, which may reallocate skb-head. In this case,...