---
id: CVE-2026-74406
title: 'vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

  udp_tunnel_sock_release() could set sk->sk_user_data to NULL
  while vxlan_gro_prepare_receive() is r…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5602c48cf87562c2f95b831d690631935e834295 <
    9c58c729d32e7cea5772cc44929c6cd61e5a31cd
  - >-
    Linux >= 5602c48cf87562c2f95b831d690631935e834295 <
    f79c80f173fda9545b220c1f094b65fc06c252d0
  - >-
    Linux >= 5602c48cf87562c2f95b831d690631935e834295 <
    08f40c0d23c67c3aa4224c3311e134999c721fb4
  - >-
    Linux >= 5602c48cf87562c2f95b831d690631935e834295 <
    4a8cde6f7281ea2c4c290f9ad9923b3631defceb
  - >-
    Linux >= 5602c48cf87562c2f95b831d690631935e834295 <
    ef44dac2a37f86eeae6b88ed10a6d60b35387dfd
  - >-
    Linux >= 5602c48cf87562c2f95b831d690631935e834295 <
    30a45c0bffdd62350261e2f2689fdba426a33578
  - Linux 4.7
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:55:52.328317Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:43.336Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74406'
references:
  - url: 'https://git.kernel.org/stable/c/9c58c729d32e7cea5772cc44929c6cd61e5a31cd'
  - url: 'https://git.kernel.org/stable/c/f79c80f173fda9545b220c1f094b65fc06c252d0'
  - url: 'https://git.kernel.org/stable/c/08f40c0d23c67c3aa4224c3311e134999c721fb4'
  - url: 'https://git.kernel.org/stable/c/4a8cde6f7281ea2c4c290f9ad9923b3631defceb'
  - url: 'https://git.kernel.org/stable/c/ef44dac2a37f86eeae6b88ed10a6d60b35387dfd'
  - url: 'https://git.kernel.org/stable/c/30a45c0bffdd62350261e2f2689fdba426a33578'
tags:
  - cve.org
epss: 0.00491
epssPercentile: 0.40816
ingestedAt: '2026-10-16T19:46:24.367Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

udp_tunnel_sock_release() could set sk->sk_user_data to NULL
while vxlan_gro_prepare_receive() is running.

Let's check if rcu_dereference_sk_user_data() is NULL after
skb_gro_remcsum_init().

## Affected

- `Linux >= 5602c48cf87562c2f95b831d690631935e834295 < 9c58c729d32e7cea5772cc44929c6cd61e5a31cd`
- `Linux >= 5602c48cf87562c2f95b831d690631935e834295 < f79c80f173fda9545b220c1f094b65fc06c252d0`
- `Linux >= 5602c48cf87562c2f95b831d690631935e834295 < 08f40c0d23c67c3aa4224c3311e134999c721fb4`
- `Linux >= 5602c48cf87562c2f95b831d690631935e834295 < 4a8cde6f7281ea2c4c290f9ad9923b3631defceb`
- `Linux >= 5602c48cf87562c2f95b831d690631935e834295 < ef44dac2a37f86eeae6b88ed10a6d60b35387dfd`
- `Linux >= 5602c48cf87562c2f95b831d690631935e834295 < 30a45c0bffdd62350261e2f2689fdba426a33578`
- `Linux 4.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.