CVE-2026-74615 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
vxlan: do not arm the ageing timer on a device that is down
vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one:
if (conf.age_interval != vxlan->cfg.age_interval) mod_timer(&vxlan->age_timer, jiffies);
There is no netif_running() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver is the timer_delete_sync() in vxlan_stop(), which is .ndo_stop. netif_close_many() drops devices without IFF_UP before __dev_close_many() runs, so that cancel is skipped for such a device.
vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a member of struct vxlan_dev, so free_netdev() releases the allocation the timer lives in while it is still queued on a timer_base. expire_timers() unlinks the entry before it loads timer->function, so the timer core writes through the freed object's list pointers:
BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654 Write of size 8 at addr ffff00001adace68 by task true/192 __asan_store8+0x84/0xac __run_timers+0x208/0x654 run_timer_softirq+0x154/0x18c Allocated by task 189: alloc_netdev_mqs+0x64/0x720 rtnl_create_link+0x4ac/0x520 rtnl_newlink+0x758/0xd00 Freed by task 191: netdev_release+0x40/0x58 netdev_run_todo+0x4a4/0x8c0 rtnl_dellink+0x200/0x4e8
The rtnl operations involved are netns-scoped, so an unprivileged user can perform them in a new user and network namespace.
Arming the timer on a down device never had an effect: vxlan_cleanup() returns early on !netif_running(), and vxlan_open() arms the timer for any non-zero interval once the device is brought up. Add the missing test.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/23/2026
The Linux kernel VXLAN driver contains a logic flaw in the vxlan_changelink function that results in an out-of-bounds memory access due to improper timer management on network devices that are not active. This vulnerability arises because the code attempts to arm the device's ageing timer whenever the requested ageing interval differs from the configured one, without first verifying whether the network interface is currently running or up. The absence of a netif_running check means that if an administrator or user modifies VXLAN settings on a device that has been created but never brought online using ip link set down, the kernel will schedule a timer callback for immediate execution. This creates a race condition where the timer infrastructure attempts to execute code associated with a network device structure that may have already been deallocated by other concurrent operations.
The operational impact of this flaw is severe, manifesting as a slab-use-after-free error detected via Kernel Address Sanitizer (KASAN). When the VXLAN device is removed or released while it remains down but has had its configuration changed, the free_netdev function releases the memory allocation containing the vxlan_dev structure. However, because the timer was previously armed with mod_timer, the kernel's timer subsystem eventually attempts to unlink and execute this callback. Since the underlying object has been freed, the timer core writes through the now-invalid list pointers within the deallocated slab cache. This results in a write of size eight bytes into memory that is no longer owned by the process or device, leading to potential system instability, kernel panics, or arbitrary code execution if an attacker can control the contents of the reclaimed memory region.
This vulnerability affects netns-scoped operations, which significantly lowers the barrier for exploitation. Because these network namespace operations are permitted for unprivileged users within their own user and network namespaces, a local attacker with standard access privileges can trigger this condition without requiring root-level permissions. The attack vector involves creating a VXLAN device, modifying its ageing interval to arm the timer, bringing the device down or allowing it to be removed while the timer is pending, and then triggering the deallocation process before the timer expires. This scenario allows an unprivileged user to cause a denial of service against the host system by crashing the kernel through this use-after-free condition.
From a classification perspective, this issue aligns with CWE-416, Use After Free, as it involves accessing memory after it has been freed due to improper lifecycle management of resources. In terms of adversary behavior, this vulnerability relates to ATT&CK technique T1059, Command and Scripting Interpreter, specifically in the context of local privilege escalation or system disruption via kernel exploitation. The root cause is a missing validation check for device state before scheduling asynchronous callbacks that depend on the persistence of specific data structures.
To mitigate this vulnerability, developers must ensure that timer operations are strictly gated by the operational status of the network interface. Specifically, the vxlan_changelink function should include a netif_running test before calling mod_timer to arm the ageing timer. This ensures that timers are only scheduled for devices that are actively running and whose memory structures are guaranteed to remain valid until they are explicitly stopped via ndo_stop. Additionally, existing cleanup routines like vxlan_cleanup already return early if the device is not running, which confirms that arming the timer on a downed interface was never intended behavior but rather an oversight in state checking. System administrators should apply kernel updates that include this fix to prevent local users from exploiting this race condition for denial of service attacks.