Linux Kernel: VXLAN Transmit Path Fix Replacing pskb_may_pull with pskb_network_may_pull

Vulnerability Overview Vulnerability Name: vxlan: use for transmit path header pulls Commit Message: In , , , and , is used to replace to validate whether the network-layer header can be pulled. This avoids mistakenly treating partial network-layer headers (such as ARP, IPv4/IPv6, and IPv6 route extension headers) as being within the linear area, thereby fixing potential issues caused by non-linear frames. Committer: Eric Dumazet Commit Time: 2026-09-17 17:32:22 +0200 Commit: Scope of Impact Affected Files: - - Affected Functions: , , , Affected Protocols: ARP, IPv4, IPv6, IPv6 route extension headers (e.g., HOP extension header) Fix Replace with to correctly determine whether the network-layer header can be safely pulled, avoiding misjudgments on non-linear frames. POC / Exploit Code ```c diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c index 454c45c9859c..9858428c81818d 100644 --- a/drivers/net/vxlan/vxlan_core.c +++ b/drivers/net/vxlan/vxlan_core.c @@ -1968,7 +1964,7 @@ static int arp_reduce(struct net_device dev, struct sk_buff skb, __be32 vni) goto out; if (!pskb_may_pull(skb, arp_hdr_len(dev)) { if (!pskb_network_may_pull(skb, arp_hdr_len(dev)) { if (skb_network_may_pull(skb, arp_hdr_len(dev)) { return arp_reduce(dev, skb, vni); goto out; @@ -2805,5 +2805,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff skb, struct net_device dev) return arp_reduce(dev, skb, vni); else if ((ipproto == ETH_P_IPV4 pskb_may_pull(skb, sizeof(struct ipv4hdr) + sizeof(struct ipv6hdr) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) + sizeof(struct ipv6_ext) +

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel: VXLAN Transmit Path Fix Replacing pskb_may_pull with pskb_network_may_pull