CVE-2026-68116

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vxlan: mdb: Fix source list corruption on a failed replace<br /> <br /> When replacing the source list of an MDB remote entry, all existing<br /> sources are first marked for deletion and vxlan_mdb_remote_srcs_add()<br /> is then called to add the new source list. Sources present in the new<br /> list have their deletion mark cleared, and any sources left marked<br /> afterwards are removed.<br /> <br /> If vxlan_mdb_remote_srcs_add() fails partway through, its error path<br /> deletes all entries on the remote&amp;#39;s source list. That rollback is only<br /> correct for its other caller, vxlan_mdb_remote_add(), where the remote<br /> was just allocated and the list contains solely entries added during<br /> the call. On the replace path the list also holds pre-existing sources,<br /> so a failed replace tears them down together with their (S, G)<br /> forwarding entries instead of leaving the entry unchanged.<br /> <br /> This is reachable from an existing (*, G) remote. An EXCLUDE filter<br /> that loses sources starts forwarding traffic that should be blocked,<br /> while an INCLUDE filter that loses sources drops traffic that should be<br /> forwarded.<br /> <br /> Mark entries created during the current pass with a new<br /> VXLAN_SGRP_F_NEW flag. On failure, delete only those entries and clear<br /> the deletion mark on the pre-existing ones, so a failed replace leaves<br /> the source list untouched. Retain the flag until the whole operation<br /> succeeds and then clear it. Also stop vxlan_mdb_remote_src_add() from<br /> deleting a pre-existing entry it only looked up when adding that<br /> entry&amp;#39;s forwarding entry fails.