CVE-2026-74615
Received Received - Intake

Use-After-Free in Linux Kernel VXLAN Driver

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one: if (conf.age_interval != vxlan->cfg.age_interval) mod_timer(&vxlan->age_timer, jiffies); There is no netif_running() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver is the timer_delete_sync() in vxlan_stop(), which is .ndo_stop. netif_close_many() drops devices without IFF_UP before __dev_close_many() runs, so that cancel is skipped for such a device. vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a member of struct vxlan_dev, so free_netdev() releases the allocation the timer lives in while it is still queued on a timer_base. expire_timers() unlinks the entry before it loads timer->function, so the timer core writes through the freed object's list pointers: BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654 Write of size 8 at addr ffff00001adace68 by task true/192 __asan_store8+0x84/0xac __run_timers+0x208/0x654 run_timer_softirq+0x154/0x18c Allocated by task 189: alloc_netdev_mqs+0x64/0x720 rtnl_create_link+0x4ac/0x520 rtnl_newlink+0x758/0xd00 Freed by task 191: netdev_release+0x40/0x58 netdev_run_todo+0x4a4/0x8c0 rtnl_dellink+0x200/0x4e8 The rtnl operations involved are netns-scoped, so an unprivileged user can perform them in a new user and network namespace. Arming the timer on a down device never had an effect: vxlan_cleanup() returns early on !netif_running(), and vxlan_open() arms the timer for any non-zero interval once the device is brought up. Add the missing test. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74615
EUVD
EUVD-2026-64552

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel vxlan *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the VXLAN (Virtual Extensible LAN) driver. When a VXLAN device is configured with an ageing timer but the device is down, the timer is still armed. If the device is later freed while the timer is still queued, it can lead to a kernel heap-use-after-free vulnerability when the timer fires.

Detection Guidance

This vulnerability is specific to the Linux kernel's VXLAN implementation and may not have direct detection commands. However, you can check if your system is running a vulnerable kernel version and inspect VXLAN device states. Use 'uname -a' to check the kernel version and 'ip link show' to inspect network interfaces. If VXLAN devices are present but not operational, they may be affected.

Impact Analysis

An unprivileged user in a new user and network namespace could exploit this to cause a kernel crash or potentially execute arbitrary code with kernel privileges. This could lead to denial of service or unauthorized system access.

Mitigation Strategies

Apply the latest kernel updates to patch this vulnerability. If immediate patching is not possible, avoid creating or using VXLAN devices in unprivileged user namespaces. Monitor kernel security advisories for updates and restrict unprivileged user namespace access if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74615. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart