---
id: CVE-2026-74475
title: 'vxlan: use neigh_ha_snapshot() in route_shortcircuit()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vxlan: use neigh_ha_snapshot() in route_shortcircuit()

  The neighbour hardware address n->ha can be updated asynchronously by the
  neighbour subsystem, protected by n->h…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    32a9590a8d30426e3db63e6b20893e47e02576c0
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    d0993fc053f29e15cc7c9fe2029df3882a2ab5ab
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    87210054bad82bbae6f483a742dc45722fb47a6b
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    ec341bb76d77b4c2948764375ee6bfeef4bb41c3
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    ff89415d34c3ab9f5312316423122e664ed3524f
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    05f2987f73daa05333fd713d05546142f9f7c5f0
  - >-
    Linux >= e4f67addf158f98f8197e08974966b18480dc751 <
    8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d
  - Linux 3.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:57:29.550730Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:48.322Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74475'
references:
  - url: 'https://git.kernel.org/stable/c/32a9590a8d30426e3db63e6b20893e47e02576c0'
  - url: 'https://git.kernel.org/stable/c/d0993fc053f29e15cc7c9fe2029df3882a2ab5ab'
  - url: 'https://git.kernel.org/stable/c/87210054bad82bbae6f483a742dc45722fb47a6b'
  - url: 'https://git.kernel.org/stable/c/d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0'
  - url: 'https://git.kernel.org/stable/c/ec341bb76d77b4c2948764375ee6bfeef4bb41c3'
  - url: 'https://git.kernel.org/stable/c/ff89415d34c3ab9f5312316423122e664ed3524f'
  - url: 'https://git.kernel.org/stable/c/05f2987f73daa05333fd713d05546142f9f7c5f0'
  - url: 'https://git.kernel.org/stable/c/8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d'
tags:
  - cve.org
epss: 0.00454
epssPercentile: 0.37989
ingestedAt: '2026-10-16T19:46:24.357Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use neigh_ha_snapshot() in route_shortcircuit()

The neighbour hardware address n->ha can be updated asynchronously by the
neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without
holding the seqlock loop can lead to torn reads or reading a partially updated
MAC address.

Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under
read_seqbegin()/read_seqretry() lock protection before using it.

Note that arp_reduce() and neigh_reduce() seem to have the same issue
left for future patches.

## Affected

- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 32a9590a8d30426e3db63e6b20893e47e02576c0`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < d0993fc053f29e15cc7c9fe2029df3882a2ab5ab`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 87210054bad82bbae6f483a742dc45722fb47a6b`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < ec341bb76d77b4c2948764375ee6bfeef4bb41c3`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < ff89415d34c3ab9f5312316423122e664ed3524f`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 05f2987f73daa05333fd713d05546142f9f7c5f0`
- `Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d`
- `Linux 3.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.