CVE-2026-89776: Linux vulnerability

CVE-2026-89776: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so validate_nla() accepts a payload shorter than the address. The GROUP consumer reads it with nla_get_in_addr(), an unconditional 4-byte load, so a short attribute over-reads up to 3 bytes of uninitialised slab data, which are stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing kernel memory. Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is always sent at full width.

UnknownCVSS not scoredNot KEV-listedUpdatedOct 19, 2026, 08:52 UTC (UTC+00:00)

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-89776 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Sep 16, 2026, 08:48 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

0ADP providers

7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Sep 11, 2026, 19:38 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Sep 16, 2026, 08:48 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Oct 19, 2026, 08:52 UTC (UTC+00:00)

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/e12c4663529699f457b2988c1dfedf4d13b3b3beCVE reference, Linux
https://git.kernel.org/stable/c/47bfcc871576eaef6c8edab6749acd4b317306eaCVE reference, Linux
https://git.kernel.org/stable/c/a9ec10815199f9879ba080241dc555efb1daf324CVE reference, Linux
https://git.kernel.org/stable/c/daebc7064a1b4c12c98e52c4bceede7f2fcd573cCVE reference, Linux
https://git.kernel.org/stable/c/ad32e564c62ebf5ba76dd60a22af52c69d54d17bCVE reference, Linux
https://git.kernel.org/stable/c/984f831dda31b3a18f47454cf64989f65402879eCVE reference, Linux

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinuxf9c4bb0b245cee35ef66f75bf409c9573d934cf9, f9c4bb0b245cee35ef66f75bf409c9573d934cf9, f9c4bb0b245cee35ef66f75bf409c9573d934cf9, f9c4bb0b245cee35ef66f75bf409c9573d934cf9, f9c4bb0b245cee35ef66f75bf409c9573d934cf9, f9c4bb0b245cee35ef66f75bf409c9573d934cf9unaffected

LinuxLinux5.18, 0, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, 7.3affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.