CVE-2026-80838: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-80838DEBIAN-CVE-2026-80838
Published 04-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-80838 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.8% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 6
MGASA-2026-0506OPENSUSE-SU-2026:11773-1OPENSUSE-SU-2026:21910-1SUSE-SU-2026:23881-1SUSE-SU-2026:23887-1SUSE-SU-2026:23897-1

Timeline

  1. 04-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: keep the last remote linked during FDB flush A non-nexthop FDB entry is expected to have at least one remote while it remains reachable through the FDB hash table. A filtered bulk flush violates this invariant when every remote matches: It unlinks the last remote in vxlan_fdb_dst_destroy() and only afterwards tells vxlan_flush() to destroy the parent FDB entry. An RCU reader can find the parent during this interval. first_remote_rcu() then applies list_entry_rcu() to the empty list head, producing an invalid remote pointer that the receive learning path can read from and write to. When a matching remote is the sole remaining remote, leave it linked and ask the caller to destroy the entire FDB entry. vxlan_fdb_destroy() keeps the remote attached while sending the deletion notification and removing the parent from the lookup structures.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

6%

Versus all other CVEs

30-day change

0.00 pp

From 0.17% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu142 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.12.111-1 | < 7.1.13-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ c499fccb71cb85902b5c5b9ce9c9ae6683e54a8f, < 2a7c2f00843225d5f037676bca649321f3d024c7 | ≥ c499fccb71cb85902b5c5b9ce9c9ae6683e54a8f, < a8820c8a7718327e96849782033e7c85a0f6bcfe | ≥ c499fccb71cb85902b5c5b9ce9c9ae6683e54a8f, < 8ba68fd6cdd1e3c92b92f25c7e48bf7bd51a183c | ≥ c499fccb71cb85902b5c5b9ce9c9ae6683e54a8f, < 4bbc76ee1b21d3bd045d6d819b2bacd30a6372ab | ≥ c499fccb71cb85902b5c5b9ce9c9ae6683e54a8f, < d5d4a7b538b52db63927773a8905fcd9f78a42e2 | 6.7

3 vendors · 145 products

References

9 links