CVE-2026-74475 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
vxlan: use neigh_ha_snapshot() in route_shortcircuit()
The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address.
Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it.
Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within the Linux kernel's VXLAN implementation where a race condition can occur during network packet processing. The flaw specifically affects the route_shortcircuit() function which handles VXLAN routing decisions, creating potential security implications for network communications. The vulnerability stems from improper handling of neighbor hardware address access within the networking subsystem, exposing systems to possible data corruption or exploitation scenarios.
The technical root cause involves the neighbor subsystem's hardware address management where n->ha can be modified asynchronously by concurrent processes while other code paths attempt to read this value without proper synchronization mechanisms. This seqlock-based protection mechanism is designed to prevent race conditions but fails when the route_shortcircuit() function accesses n->ha outside of the required read_seqbegin()/read_seqretry() protective context. The asynchronous updates can result in torn reads or partial MAC address values being consumed by the routing logic, potentially leading to incorrect forwarding decisions.
The operational impact of this vulnerability extends across all systems utilizing VXLAN networking with Linux kernels that contain the affected code path. Network traffic may experience intermittent failures or incorrect routing decisions when VXLAN packets traverse affected systems, potentially causing service disruption or data loss. The vulnerability represents a medium severity risk according to standard security frameworks and could be exploited by attackers to perform network-level disruptions or potentially escalate privileges through carefully crafted network traffic patterns that trigger the race condition.
The fix implements proper synchronization using the neigh_ha_snapshot() function which correctly handles the seqlock protection required for reading neighbor hardware addresses. This approach safely copies the n->ha value under appropriate read_seqbegin()/read_seqretry() lock protection before the value is utilized in routing decisions. The solution follows established kernel security practices and aligns with CWE-362, which addresses race conditions in concurrent programming environments. Additionally, this vulnerability maps to ATT&CK technique T1071.004 for application layer protocol manipulation and potentially T1562.001 for privilege escalation through kernel exploitation.
Security practitioners should prioritize patching affected Linux kernel versions to address this vulnerability, particularly in environments where VXLAN networking is actively used. The remediation process requires updating to kernel versions containing the specific fix that implements proper seqlock handling around neighbor hardware address access. Organizations should monitor their network infrastructure for any intermittent connectivity issues or VXLAN-related failures that might indicate exploitation attempts, as the race condition may not always manifest consistently but can still cause significant operational impacts.
The vulnerability highlights broader concerns about synchronization mechanisms in kernel networking code and demonstrates how seemingly minor concurrency issues can lead to significant security implications. While immediate exploitation risks appear limited, the potential for escalation through combined attacks or specific network conditions makes prompt remediation essential. The fix implementation follows established kernel development practices and represents a standard approach to resolving seqlock-related race conditions in kernel networking subsystems, ensuring proper memory ordering and atomic access patterns throughout the neighbor resolution process.