CVE-2026-74615

vxlan: do not arm the ageing timer on a device that is down

Published Aug 22, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not arm the ageing timer on a device that is down

vxlan_changelink() arms vxlan->age_timer whenever the requested ageing
interval differs from the configured one:

if (conf.age_interval != vxlan->cfg.age_interval)
mod_timer(&vxlan->age_timer, jiffies);

There is no netif_running() test, so the timer is armed even on a device
that was never brought up. The only synchronous cancel in the driver is
the timer_delete_sync() in vxlan_stop(), which is .ndo_stop.
netif_close_many() drops devices without IFF_UP before
__dev_close_many() runs, so that cancel is skipped for such a device.

vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a
member of struct vxlan_dev, so free_netdev() releases the allocation the
timer lives in while it is still queued on a timer_base.
expire_timers() unlinks the entry before it loads timer->function, so
the timer core writes through the freed object's list pointers:

BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654
Write of size 8 at addr ffff00001adace68 by task true/192
__asan_store8+0x84/0xac
__run_timers+0x208/0x654
run_timer_softirq+0x154/0x18c
Allocated by task 189:
alloc_netdev_mqs+0x64/0x720
rtnl_create_link+0x4ac/0x520
rtnl_newlink+0x758/0xd00
Freed by task 191:
netdev_release+0x40/0x58
netdev_run_todo+0x4a4/0x8c0
rtnl_dellink+0x200/0x4e8

The rtnl operations involved are netns-scoped, so an unprivileged user
can perform them in a new user and network namespace.

Arming the timer on a down device never had an effect: vxlan_cleanup()
returns early on !netif_running(), and vxlan_open() arms the timer for
any non-zero interval once the device is brought up. Add the missing
test.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Analysis

Technical impact

The kernel exposes a use‑after‑free condition in the VXLAN driver; when a VXLAN interface is brought down without a netif_running() check, the ageing timer is incorrectly armed and scheduled to run; the subsequent timer tick dereferences a freed struct, triggering KASAN and resulting in kernel memory corruption that can be leveraged for arbitrary code execution or privilege escalation by an attacker using user or network namespace operations.

Affected Systems

All versions of the Linux kernel that support VXLAN are potentially affected, as the flaw resides in the generic vxlan_* driver code present in every kernel configuration that enables VXLAN support; the product is the Linux kernel itself, and no specific vendor or version is excluded.

Risk and Exploitability

The vulnerability thrives on local attack vectors where an unprivileged user can perform rtnl operations to create or delete VXLAN links within a network namespace; the CVSS score of 8.8 indicates high severity, and the use‑after‑free nature and potential for arbitrary code execution reinforce its risk; EPSS is <1%, and the issue is not catalogued in the CISA KEV catalog, yet administrators should consider it a critical risk until a patched kernel is deployed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`40051c4dcad5b374156ad9cceae8d15c0ef1cb95`	affected	< be44d79d14d7f9ae7c8ffb7272142005341b5123
`40051c4dcad5b374156ad9cceae8d15c0ef1cb95`	affected	< 26c179d47403d2f919ee914cc02c31d896b59fee
`40051c4dcad5b374156ad9cceae8d15c0ef1cb95`	affected	< 9dc561f0522c35bdd66e0646a748814a138ec4ca
`40051c4dcad5b374156ad9cceae8d15c0ef1cb95`	affected	< 619dd29045e439d0b0f8c6d4fec1af447a050680
`40051c4dcad5b374156ad9cceae8d15c0ef1cb95`	affected	< 6b095e99b9e67ea31f0c4b00260e010898253519
`40051c4dcad5b374156ad9cceae8d15c0ef1cb95`	affected	< 46bb297ad77680e009244f067f27d51cf5b8c7cf
`40051c4dcad5b374156ad9cceae8d15c0ef1cb95`	affected	< 6b4119af544996a545cf84b16f1dbce829ba0de8
`40051c4dcad5b374156ad9cceae8d15c0ef1cb95`	affected	< b37971686ec59fb027fa4910ba16805e68fddb97

Linux

affected

Version	Status	Constraints
`5.0`	affected	—
`0`	unaffected	< 5.0
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[40051c4dcad5b374156ad9cceae8d15c0ef1cb95,be44d79d14d7f9ae7c8ffb7272142005341b5123)`	affected	code_commit	—
`[40051c4dcad5b374156ad9cceae8d15c0ef1cb95,26c179d47403d2f919ee914cc02c31d896b59fee)`	affected	code_commit	—
`[40051c4dcad5b374156ad9cceae8d15c0ef1cb95,9dc561f0522c35bdd66e0646a748814a138ec4ca)`	affected	code_commit	—
`[40051c4dcad5b374156ad9cceae8d15c0ef1cb95,619dd29045e439d0b0f8c6d4fec1af447a050680)`	affected	code_commit	—
`[40051c4dcad5b374156ad9cceae8d15c0ef1cb95,6b095e99b9e67ea31f0c4b00260e010898253519)`	affected	code_commit	—
`[40051c4dcad5b374156ad9cceae8d15c0ef1cb95,46bb297ad77680e009244f067f27d51cf5b8c7cf)`	affected	code_commit	—
`[40051c4dcad5b374156ad9cceae8d15c0ef1cb95,6b4119af544996a545cf84b16f1dbce829ba0de8)`	affected	code_commit	—
`[40051c4dcad5b374156ad9cceae8d15c0ef1cb95,b37971686ec59fb027fa4910ba16805e68fddb97)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.0`	affected	generic	—
`[0,5.0)`	unaffected	generic	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the CVE-2026-74615 fix, such as those released after the patch commit referenced in the advisory links.
Temporarily remove or disable any unused VXLAN interfaces until the kernel is patched, to prevent the use-after-free condition from being triggered.
Enable kernel KASAN (Kernel Address Sanitizer) in testing environments to detect potential timer-related memory corruption early, and monitor system logs for KASAN-related error messages indicating exploitation attempts.

Generated by OpenCVE AI on August 25, 2026 at 13:44 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.126% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/26c179d47403d2f919ee914cc02c31d896b59fee
https://git.kernel.org/stable/c/46bb297ad77680e009244f067f27d51cf5b8c7cf
https://git.kernel.org/stable/c/619dd29045e439d0b0f8c6d4fec1af447a050680
https://git.kernel.org/stable/c/6b095e99b9e67ea31f0c4b00260e010898253519
https://git.kernel.org/stable/c/6b4119af544996a545cf84b16f1dbce829ba0de8
https://git.kernel.org/stable/c/9dc561f0522c35bdd66e0646a748814a138ec4ca
https://git.kernel.org/stable/c/b37971686ec59fb027fa4910ba16805e68fddb97
https://git.kernel.org/stable/c/be44d79d14d7f9ae7c8ffb7272142005341b5123
https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74615-832f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74615
https://www.cve.org/CVERecord?id=CVE-2026-74615

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026082218-CVE-2026-74615-832f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74615 https://www.cve.org/CVERecord?id=CVE-2026-74615
Metrics	threat_severity `None`	threat_severity `Important`

Aug 25, 2026 5:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Aug 22, 2026 5:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-250 CWE-416

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one: if (conf.age_interval != vxlan->cfg.age_interval) mod_timer(&vxlan->age_timer, jiffies); There is no netif_running() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver is the timer_delete_sync() in vxlan_stop(), which is .ndo_stop. netif_close_many() drops devices without IFF_UP before __dev_close_many() runs, so that cancel is skipped for such a device. vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a member of struct vxlan_dev, so free_netdev() releases the allocation the timer lives in while it is still queued on a timer_base. expire_timers() unlinks the entry before it loads timer->function, so the timer core writes through the freed object's list pointers: BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654 Write of size 8 at addr ffff00001adace68 by task true/192 __asan_store8+0x84/0xac __run_timers+0x208/0x654 run_timer_softirq+0x154/0x18c Allocated by task 189: alloc_netdev_mqs+0x64/0x720 rtnl_create_link+0x4ac/0x520 rtnl_newlink+0x758/0xd00 Freed by task 191: netdev_release+0x40/0x58 netdev_run_todo+0x4a4/0x8c0 rtnl_dellink+0x200/0x4e8 The rtnl operations involved are netns-scoped, so an unprivileged user can perform them in a new user and network namespace. Arming the timer on a down device never had an effect: vxlan_cleanup() returns early on !netif_running(), and vxlan_open() arms the timer for any non-zero interval once the device is brought up. Add the missing test. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Title		vxlan: do not arm the ageing timer on a device that is down
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/26c179d47403d2f919ee914cc02c31d896b59fee https://git.kernel.org/stable/c/46bb297ad77680e009244f067f27d51cf5b8c7cf https://git.kernel.org/stable/c/619dd29045e439d0b0f8c6d4fec1af447a050680 https://git.kernel.org/stable/c/6b095e99b9e67ea31f0c4b00260e010898253519 https://git.kernel.org/stable/c/6b4119af544996a545cf84b16f1dbce829ba0de8 https://git.kernel.org/stable/c/9dc561f0522c35bdd66e0646a748814a138ec4ca https://git.kernel.org/stable/c/b37971686ec59fb027fa4910ba16805e68fddb97 https://git.kernel.org/stable/c/be44d79d14d7f9ae7c8ffb7272142005341b5123