Database/Firmware, BMC & network fabric
Linux VXLAN driver (neighbour hardware address read in route_shortcircuit): TENANT ISOLATION: `route_shortcircuit()`
Impact
TENANT ISOLATION: route_shortcircuit() reads a neighbour's hardware address without taking the seqlock that protects it, so it can observe a torn or partially-updated MAC address while the neighbour subsystem is rewriting it. In an overlay, the destination MAC is what decides which VTEP — and therefore which tenant's segment — a frame is delivered to. A torn read there is not just a memory-safety problem; it is a frame going somewhere the forwarding logic did not intend.
Who can reach it
Concurrent neighbour updates alongside VXLAN forwarding on an affected host or software VTEP. Triggerable by ordinary overlay traffic combined with neighbour churn, which tenants generate routinely.
What to do
Kernel upgrade plus host reboot, or NOS image upgrade plus switch reload on Linux-based switches. Bundle with the rest of the 2026 VXLAN batch.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.