# CVE-2026-68116: vxlan: mdb: Fix source list corruption on a failed replace

> A flaw in Linux kernel VXLAN MDB handling allows attackers to disrupt traffic forwarding or bypass filters by triggering a failed source list replacement.

- **Severity:** High 7.9 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Aug 2026
- **Updated:** 19 Oct 2026
- **Also known as:** BELL-CVE-2026-68116, DEBIAN-CVE-2026-68116, GHSA-qqrm-rmvj-6vv2, UBUNTU-CVE-2026-68116

## What is CVE-2026-68116?

CVE-2026-68116 is a high-severity denial of service vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: mdb: Fix source list corruption on a failed replace

When replacing the source list of an MDB remote entry, all existing
sources are first marked for deletion and vxlan_mdb_remote_srcs_add()
is then called to add the new source list. Sources present in the new
list have their deletion mark cleared, and any sources left marked
afterwards are removed.

If vxlan_mdb_remote_srcs_add() fails partway through, its error path
deletes all entries on the remote's source list. That rollback is only
correct for its other caller, vxlan_mdb_remote_add(), where the remote
was just allocated and the list contains solely entries added during
the call. On the replace path the list also holds pre-existing sources,
so a failed replace tears them down together with their (S, G)
forwarding entries instead of leaving the entry unchanged.

This is reachable from an existing (*, G) remote. An EXCLUDE filter
that loses sources starts forwarding traffic that should be blocked,
while an INCLUDE filter that loses sources drops traffic that should be
forwarded.

Mark entries created during the current pass with a new
VXLAN_SGRP_F_NEW flag. On failure, delete only those entries and clear
the deletion mark on the pre-existing ones, so a failed replace leaves
the source list untouched. Retain the flag until the whole operation
succeeds and then clear it. Also stop vxlan_mdb_remote_src_add() from
deleting a pre-existing entry it only looked up when adding that
entry's forwarding entry fails.

## Which versions are affected by CVE-2026-68116?


## How do I fix CVE-2026-68116?

Apply the vendor's patch.

## Is CVE-2026-68116 being exploited?

There is no known exploitation of CVE-2026-68116 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-68116 and fix it if it is affected.

What it is: CVE-2026-68116 is a high-severity denial of service vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-68116 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-68116/ (Markdown: https://insights.sbomify.com/CVE-2026-68116/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-68116
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68116
- OSV: https://osv.dev/vulnerability/CVE-2026-68116

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-68116/
Summaries are generated and may contain mistakes; the official description above is the record.