A critical use-after-free vulnerability in the Linux kernel vxlan module poses a severe risk of system instability or unauthorized code execution.

The vulnerability exists in the vxlan_xmit function where an Ethernet header pointer is cached before a call to route_shortcircuit. Because route_shortcircuit can trigger memory reallocation via pskb_may_pull, the cached pointer becomes stale, leading to a use-after-free condition when the kernel later accesses the freed memory.

This flaw carries a CVSS score of 9.8, indicating a critical severity level due to the potential for unauthenticated remote exploitation. Successful exploitation could lead to arbitrary code execution with kernel-level privileges, resulting in full system compromise, data exfiltration, or persistent denial of service. Such an event would likely cause significant operational downtime and jeopardize the integrity of the entire infrastructure.

Immediate Action: Update the Linux kernel to the corrected versions (5.10.265, 5.15.216, 6.1.183, 6.6.151, or later) immediately to resolve the memory management error.

Proactive Monitoring: Monitor kernel logs for signs of memory corruption, unexpected system reboots, or kernel panics that may indicate an exploitation attempt.

Compensating Controls: While kernel patches are the only definitive fix, network-level ingress filtering and restricting access to vxlan interfaces can reduce the attack surface for remote exploitation.

Public Exploit Available: Unknown.

Given the critical nature of this kernel-level memory vulnerability, administrators must prioritize patching as part of an emergency maintenance cycle. Failure to apply these updates leaves the system exposed to potential remote code execution, which could have catastrophic impacts on host and network security.