CVE-2026-74475

Received Received - Intake

Race Condition in Linux Kernel VXLAN Implementation

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neigh_ha_snapshot() in route_shortcircuit() The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address. Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it. Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74475

EUVD

EUVD-2026-59668

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the neighbour hardware address (MAC address) in VXLAN operations can be read unsafely. The issue occurs because the address can change asynchronously while being read without proper locking, leading to potential torn reads or partial updates.

Detection Guidance

This vulnerability involves potential race conditions in the Linux kernel's VXLAN neighbor handling. Detection requires checking kernel logs for related errors or kernel crashes. Commands like dmesg | grep -i vxlan or journalctl -k | grep -i vxlan may help identify issues. Kernel version checks with uname -r can confirm if your system is affected.

Impact Analysis

This could cause network communication issues in systems using VXLAN, as incorrect or corrupted MAC addresses might be used for routing. It may lead to packet loss, connection failures, or security bypasses if attackers exploit the race condition.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a race condition in the Linux kernel's VXLAN handling that could lead to incorrect MAC address reads, which may impact network integrity but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patches are unavailable, monitor for kernel crashes or network instability related to VXLAN. Consider disabling VXLAN if not critical until patched.

Hi! I’m here to help you understand CVE-2026-74475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70