{"id":"CVE-2026-74406","state":"PUBLISHED","title":"vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().\n\nudp_tunnel_sock_release() could set sk->sk_user_data to NULL\nwhile vxlan_gro_prepare_receive() is running.\n\nLet's check if rcu_dereference_sk_user_data() is NULL after\nskb_gro_remcsum_init().","publishedAt":"2026-08-15T05:59:15.385Z","updatedAt":"2026-10-30T12:29:59.646Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"022af89207fcc992ec5c712c14e2e018c335eb1e","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"a3104cc1fed994519538301efcaab175f9af6008","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"9c58c729d32e7cea5772cc44929c6cd61e5a31cd","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"f79c80f173fda9545b220c1f094b65fc06c252d0","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"08f40c0d23c67c3aa4224c3311e134999c721fb4","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"4a8cde6f7281ea2c4c290f9ad9923b3631defceb","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"ef44dac2a37f86eeae6b88ed10a6d60b35387dfd","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"30a45c0bffdd62350261e2f2689fdba426a33578","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/vxlan/vxlan_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.7","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/vxlan/vxlan_core.c"]}],"references":["https://git.kernel.org/stable/c/022af89207fcc992ec5c712c14e2e018c335eb1e","https://git.kernel.org/stable/c/a3104cc1fed994519538301efcaab175f9af6008","https://git.kernel.org/stable/c/9c58c729d32e7cea5772cc44929c6cd61e5a31cd","https://git.kernel.org/stable/c/f79c80f173fda9545b220c1f094b65fc06c252d0","https://git.kernel.org/stable/c/08f40c0d23c67c3aa4224c3311e134999c721fb4","https://git.kernel.org/stable/c/4a8cde6f7281ea2c4c290f9ad9923b3631defceb","https://git.kernel.org/stable/c/ef44dac2a37f86eeae6b88ed10a6d60b35387dfd","https://git.kernel.org/stable/c/30a45c0bffdd62350261e2f2689fdba426a33578"],"weaknesses":[],"ingestedAt":"2026-10-30T12:48:04.825Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74406.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74406","state":"PUBLISHED","datePublished":"2026-08-15T05:59:15.385Z","dateUpdated":"2026-10-30T12:29:59.646Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.892Z"},"containers":{"cna":{"title":"vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().\n\nudp_tunnel_sock_release() could set sk->sk_user_data to NULL\nwhile vxlan_gro_prepare_receive() is running.\n\nLet's check if rcu_dereference_sk_user_data() is NULL after\nskb_gro_remcsum_init()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"022af89207fcc992ec5c712c14e2e018c335eb1e","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"a3104cc1fed994519538301efcaab175f9af6008","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"9c58c729d32e7cea5772cc44929c6cd61e5a31cd","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"f79c80f173fda9545b220c1f094b65fc06c252d0","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"08f40c0d23c67c3aa4224c3311e134999c721fb4","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"4a8cde6f7281ea2c4c290f9ad9923b3631defceb","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"ef44dac2a37f86eeae6b88ed10a6d60b35387dfd","versionType":"git"},{"version":"5602c48cf87562c2f95b831d690631935e834295","status":"affected","lessThan":"30a45c0bffdd62350261e2f2689fdba426a33578","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/vxlan/vxlan_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.7","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/vxlan/vxlan_core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/022af89207fcc992ec5c712c14e2e018c335eb1e"},{"url":"https://git.kernel.org/stable/c/a3104cc1fed994519538301efcaab175f9af6008"},{"url":"https://git.kernel.org/stable/c/9c58c729d32e7cea5772cc44929c6cd61e5a31cd"},{"url":"https://git.kernel.org/stable/c/f79c80f173fda9545b220c1f094b65fc06c252d0"},{"url":"https://git.kernel.org/stable/c/08f40c0d23c67c3aa4224c3311e134999c721fb4"},{"url":"https://git.kernel.org/stable/c/4a8cde6f7281ea2c4c290f9ad9923b3631defceb"},{"url":"https://git.kernel.org/stable/c/ef44dac2a37f86eeae6b88ed10a6d60b35387dfd"},{"url":"https://git.kernel.org/stable/c/30a45c0bffdd62350261e2f2689fdba426a33578"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in vxlan_gro_prepare_receive() on the UDP GRO receive path; remote VXLAN/UDP packets reach it via inet_gro_receive→udp4_gro_receive→udp_tunnel_gro_rcv→vxlan_gro_receive during NAPI processing on internet/cloud overlay endpoints.\nAC:L - An attacker can reliably trigger the race by flooding VXLAN GRO packets while concurrently tearing down the VXLAN device (e.g., via CAP_NET_ADMIN in a user namespace); repeated attempts during orchestrated interface churn also make the timing window attacker-driven rather than purely environmental.\nPR:N - Exploitation requires only the ability to send crafted VXLAN UDP traffic to a listening tunnel port; no target credentials or local account are needed, and concurrent teardown can occur from normal administrative or automation activity rather than attacker-held privileges.\nUI:N - No victim interaction is required beyond the host already running a VXLAN interface; the attacker triggers the fault purely by sending network packets timed against interface teardown.\nS:U - Impact is a kernel fault in networking softirq context on the same host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - The race can leave a stale vxlan_sock pointer after udp_tunnel_sock_release() frees sk_user_data; dereferencing vs->flags is a use-after-free read that can expose kernel heap contents and is treated as arbitrary read potential under conservative scoring.\nI:H - Use-after-free on the vxlan_sock object during GRO teardown can corrupt heap metadata or adjacent objects and be leveraged for control-flow hijacking, not merely a benign NULL check failure.\nA:H - A successful trigger causes a kernel NULL pointer dereference/oops in NAPI/softirq context (documented crash at vxlan_gro_prepare_receive), typically crashing or hanging the host and denying all services."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:29:59.646Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-74406","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:55:52.328317Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:05:43.336Z"}}]}}}