Database/Control plane, storage & DevOps
Linux VXLAN driver (neighbour hardware address read in route_shortcircuit): `route_shortcircuit()` reads a neighbour's
Impact
route_shortcircuit() reads a neighbour's hardware address without taking the seqlock that protects it, so it can observe a torn or partially-updated MAC address while the neighbour subsystem is rewriting it. In an overlay, the destination MAC is what decides which VTEP — and therefore which tenant's segment — a frame is delivered to. A torn read there is not just a memory-safety problem; it is a frame going somewhere the forwarding logic did not intend.
Who can reach it
Concurrent neighbour updates alongside VXLAN forwarding on an affected host or software VTEP. Triggerable by ordinary overlay traffic combined with neighbour churn, which tenants generate routinely.
What to do
Kernel upgrade plus host reboot, or NOS image upgrade plus switch reload on Linux-based switches. Bundle with the rest of the 2026 VXLAN batch.
References
Related entries
- Cisco ISE: unauthenticated API endpoint allows full authentication bypass on the applianceCVE-2026-76460 · Cisco Identity Services Engine (unauthenticated API endpoint)Critical
- SonicWall SMA1000: pre-auth SSRF via an unintended alternate access path in the Work Place interfaceCVE-2026-83548 · SonicWall SMA1000 appliance (Work Place interface, alternate access path)Critical
- GitLab: unauthenticated arbitrary file read via the repository commits APICVE-2026-85706 · GitLab CE/EE (repository commits API)Critical
- Kubeflow Pipelines frontend (/_proxy/ route, proxy-middleware.ts): The pipelines frontend hands any unauthenticatedNCVD-2026-042-kubeflow-pipelines-frontend-prox · Kubeflow Pipelines frontend (/_proxy/ route, proxy-middleware.ts)Critical
- HTCondor (condor_credd): condor_credd can be told to create or write files as root outsideCVE-2021-25311 · HTCondor (condor_credd)Critical
- RKE / Rancher (k8s control plane): full-cluster-state configmap in kube-system readable by non-adminsCVE-2023-32191 · RKE / Rancher (k8s control plane)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.