{"id":"CVE-2026-74475","title":"vxlan: use neigh_ha_snapshot() in route_shortcircuit()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use neigh_ha_snapshot() in route_shortcircuit()\n\nThe neighbour hardware address n->ha can be updated asynchronously by the\nneighbour subsystem, protected by n->h…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 32a9590a8d30426e3db63e6b20893e47e02576c0","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < d0993fc053f29e15cc7c9fe2029df3882a2ab5ab","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 87210054bad82bbae6f483a742dc45722fb47a6b","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < ec341bb76d77b4c2948764375ee6bfeef4bb41c3","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < ff89415d34c3ab9f5312316423122e664ed3524f","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 05f2987f73daa05333fd713d05546142f9f7c5f0","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d","Linux 3.8"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T18:57:29.550730Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:48.322Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74475","references":[{"url":"https://git.kernel.org/stable/c/32a9590a8d30426e3db63e6b20893e47e02576c0"},{"url":"https://git.kernel.org/stable/c/d0993fc053f29e15cc7c9fe2029df3882a2ab5ab"},{"url":"https://git.kernel.org/stable/c/87210054bad82bbae6f483a742dc45722fb47a6b"},{"url":"https://git.kernel.org/stable/c/d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0"},{"url":"https://git.kernel.org/stable/c/ec341bb76d77b4c2948764375ee6bfeef4bb41c3"},{"url":"https://git.kernel.org/stable/c/ff89415d34c3ab9f5312316423122e664ed3524f"},{"url":"https://git.kernel.org/stable/c/05f2987f73daa05333fd713d05546142f9f7c5f0"},{"url":"https://git.kernel.org/stable/c/8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d"}],"tags":["cve.org"],"epss":0.00454,"epssPercentile":0.37989,"ingestedAt":"2026-10-16T19:46:24.357Z","slug":"CVE-2026-74475","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use neigh_ha_snapshot() in route_shortcircuit()\n\nThe neighbour hardware address n->ha can be updated asynchronously by the\nneighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without\nholding the seqlock loop can lead to torn reads or reading a partially updated\nMAC address.\n\nUse neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under\nread_seqbegin()/read_seqretry() lock protection before using it.\n\nNote that arp_reduce() and neigh_reduce() seem to have the same issue\nleft for future patches.\n\n## Affected\n\n- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 32a9590a8d30426e3db63e6b20893e47e02576c0`\n- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < d0993fc053f29e15cc7c9fe2029df3882a2ab5ab`\n- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 87210054bad82bbae6f483a742dc45722fb47a6b`\n- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0`\n- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < ec341bb76d77b4c2948764375ee6bfeef4bb41c3`\n- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < ff89415d34c3ab9f5312316423122e664ed3524f`\n- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 05f2987f73daa05333fd713d05546142f9f7c5f0`\n- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d`\n- `Linux 3.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}