CVE-2026-74615 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize vxlan. These stakeholders should review and apply patches to fix the vulnerability, and monitor the system for potential denial-of-service (DoS) attacks or other malicious activity.

Why it matters

A use-after-free vulnerability in the Linux kernel's vxlan implementation can cause a denial-of-service (DoS) or potentially allow an attacker to execute arbitrary code. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems that utilize vxlan should review and apply patches to fix the vulnerability.

• Denial-of-service (DoS) attacks may be possible due to the use-after-free error.
• Potential code execution may occur if an attacker can trigger the timer expiration.

Technical summary

The vulnerability exists in the vxlan implementation of the Linux kernel. The vxlan_changelink() function arms the ageing timer without checking if the device is down. When the device is down, the timer is not disarmed, leading to a use-after-free error when the timer expires. The vulnerability is caused by the lack of a netif_running() test in the vxlan_changelink() function, which arms the ageing timer even when the device is down. This can cause a denial-of-service (DoS) or potentially allow an attacker to execute arbitrary code.

Defensive priority

High

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers to fix the vulnerability.
• Ensure that the Linux kernel is updated to a version that includes the fix.
• Monitor the system for potential denial-of-service (DoS) attacks or other malicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the lack of a netif_running() test in the vxlan_changelink() function, which arms the ageing timer even when the device is down. The timer is not disarmed when the device is brought down, leading to a use-after-free error when the timer expires.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.