{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74406","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.892Z","datePublished":"2026-08-15T05:59:15.385Z","dateUpdated":"2026-08-17T05:46:49.365Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:46:49.365Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().\n\nudp_tunnel_sock_release() could set sk->sk_user_data to NULL\nwhile vxlan_gro_prepare_receive() is running.\n\nLet's check if rcu_dereference_sk_user_data() is NULL after\nskb_gro_remcsum_init()."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in vxlan_gro_prepare_receive() on the UDP GRO receive path; remote VXLAN/UDP packets reach it via inet_gro_receive→udp4_gro_receive→udp_tunnel_gro_rcv→vxlan_gro_receive during NAPI processing on internet/cloud overlay endpoints.\nAC:L - An attacker can reliably trigger the race by flooding VXLAN GRO packets while concurrently tearing down the VXLAN device (e.g., via CAP_NET_ADMIN in a user namespace); repeated attempts during orchestrated interface churn also make the timing window attacker-driven rather than purely environmental.\nPR:N - Exploitation requires only the ability to send crafted VXLAN UDP traffic to a listening tunnel port; no target credentials or local account are needed, and concurrent teardown can occur from normal administrative or automation activity rather than attacker-held privileges.\nUI:N - No victim interaction is required beyond the host already running a VXLAN interface; the attacker triggers the fault purely by sending network packets timed against interface teardown.\nS:U - Impact is a kernel fault in networking softirq context on the same host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - The race can leave a stale vxlan_sock pointer after udp_tunnel_sock_release() frees sk_user_data; dereferencing vs->flags is a use-after-free read that can expose kernel heap contents and is treated as arbitrary read potential under conservative scoring.\nI:H - Use-after-free on the vxlan_sock object during GRO teardown can corrupt heap metadata or adjacent objects and be leveraged for control-flow hijacking, not merely a benign NULL check failure.\nA:H - A successful trigger causes a kernel NULL pointer dereference/oops in NAPI/softirq context (documented crash at vxlan_gro_prepare_receive), typically crashing or hanging the host and denying all services."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/vxlan/vxlan_core.c"],"versions":[{"version":"5602c48cf87562c2f95b831d690631935e834295","lessThan":"9c58c729d32e7cea5772cc44929c6cd61e5a31cd","status":"affected","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","lessThan":"f79c80f173fda9545b220c1f094b65fc06c252d0","status":"affected","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","lessThan":"08f40c0d23c67c3aa4224c3311e134999c721fb4","status":"affected","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","lessThan":"4a8cde6f7281ea2c4c290f9ad9923b3631defceb","status":"affected","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","lessThan":"ef44dac2a37f86eeae6b88ed10a6d60b35387dfd","status":"affected","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","lessThan":"30a45c0bffdd62350261e2f2689fdba426a33578","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/vxlan/vxlan_core.c"],"versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","status":"unaffected","versionType":"semver"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9c58c729d32e7cea5772cc44929c6cd61e5a31cd"},{"url":"https://git.kernel.org/stable/c/f79c80f173fda9545b220c1f094b65fc06c252d0"},{"url":"https://git.kernel.org/stable/c/08f40c0d23c67c3aa4224c3311e134999c721fb4"},{"url":"https://git.kernel.org/stable/c/4a8cde6f7281ea2c4c290f9ad9923b3631defceb"},{"url":"https://git.kernel.org/stable/c/ef44dac2a37f86eeae6b88ed10a6d60b35387dfd"},{"url":"https://git.kernel.org/stable/c/30a45c0bffdd62350261e2f2689fdba426a33578"}],"title":"vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().","x_generator":{"engine":"bippy-1.2.0"}}}}