{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-68116 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-68116 is a high-severity denial of service vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-68116 and fix it if it is affected.\n\nWhat it is: CVE-2026-68116 is a high-severity denial of service vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-68116 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-68116/ (Markdown: https://insights.sbomify.com/CVE-2026-68116/index.md)","id":"CVE-2026-68116","markdown":"https://insights.sbomify.com/CVE-2026-68116/index.md","name":"CVE-2026-68116","record":{"aliases":["BELL-CVE-2026-68116","DEBIAN-CVE-2026-68116","GHSA-qqrm-rmvj-6vv2","UBUNTU-CVE-2026-68116"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","security_bypass"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel VXLAN","requires_auth":"low_privilege","summary":"A flaw in Linux kernel VXLAN MDB handling allows attackers to disrupt traffic forwarding or bypass filters by triggering a failed source list replacement.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.9,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix source list corruption on a failed replace\n\nWhen replacing the source list of an MDB remote entry, all existing\nsources are first marked for deletion and vxlan_mdb_remote_srcs_add()\nis then called to add the new source list. Sources present in the new\nlist have their deletion mark cleared, and any sources left marked\nafterwards are removed.\n\nIf vxlan_mdb_remote_srcs_add() fails partway through, its error path\ndeletes all entries on the remote's source list. That rollback is only\ncorrect for its other caller, vxlan_mdb_remote_add(), where the remote\nwas just allocated and the list contains solely entries added during\nthe call. On the replace path the list also holds pre-existing sources,\nso a failed replace tears them down together with their (S, G)\nforwarding entries instead of leaving the entry unchanged.\n\nThis is reachable from an existing (*, G) remote. An EXCLUDE filter\nthat loses sources starts forwarding traffic that should be blocked,\nwhile an INCLUDE filter that loses sources drops traffic that should be\nforwarded.\n\nMark entries created during the current pass with a new\nVXLAN_SGRP_F_NEW flag. On failure, delete only those entries and clear\nthe deletion mark on the pre-existing ones, so a failed replace leaves\nthe source list untouched. Retain the flag until the whole operation\nsucceeds and then clear it. Also stop vxlan_mdb_remote_src_add() from\ndeleting a pre-existing entry it only looked up when adding that\nentry's forwarding entry fails.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"vxlan: mdb: Fix source list corruption on a failed replace","id":"CVE-2026-68116","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create()","id":"CVE-2026-68117"},"packages":[],"prev":{"headline":"drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()","id":"CVE-2026-68115"},"products":["Linux"],"published":"2026-08-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A flaw in Linux kernel VXLAN MDB handling allows attackers to disrupt traffic forwarding or bypass filters by triggering a failed source list replacement.","url":"https://insights.sbomify.com/CVE-2026-68116/"}