CVE-2026-74475

Summary

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use neigh_ha_snapshot() in route_shortcircuit()

The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address.

Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it.

Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0affected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < ec341bb76d77b4c2948764375ee6bfeef4bb41c3affected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < ff89415d34c3ab9f5312316423122e664ed3524faffected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < 05f2987f73daa05333fd713d05546142f9f7c5f0affected
LinuxLinuxe4f67addf158f98f8197e08974966b18480dc751 < 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473daffected
LinuxLinux3.8affected
LinuxLinux0 < 3.8unaffected
LinuxLinux6.6.151 <= 6.6.*unaffected
LinuxLinux6.12.103 <= 6.12.*unaffected
LinuxLinux6.18.44 <= 6.18.*unaffected
LinuxLinux7.1.8 <= 7.1.*unaffected
LinuxLinux7.2-rc6 <= *unaffected

Weaknesses

References