CVE-2026-74475

Summary

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use neigh_ha_snapshot() in route_shortcircuit()

The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address.

Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it.

Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < 32a9590a8d30426e3db63e6b20893e47e02576c0affected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < d0993fc053f29e15cc7c9fe2029df3882a2ab5abaffected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < 87210054bad82bbae6f483a742dc45722fb47a6baffected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0affected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < ec341bb76d77b4c2948764375ee6bfeef4bb41c3affected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < ff89415d34c3ab9f5312316423122e664ed3524faffected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < 05f2987f73daa05333fd713d05546142f9f7c5f0affected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473daffected
LinuxLinux3.8affected
LinuxLinux0 < 3.8unaffected
LinuxLinux5.10.265 <= 5.10.*unaffected
LinuxLinux5.15.216 <= 5.15.*unaffected
LinuxLinux6.1.183 <= 6.1.*unaffected
LinuxLinux6.6.151 <= 6.6.*unaffected
LinuxLinux6.12.103 <= 6.12.*unaffected
LinuxLinux6.18.44 <= 6.18.*unaffected
LinuxLinux7.1.8 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References