What is CVE-2026-74475?
In the Linux kernel, the VXLAN `route_shortcircuit()` function reads the neighbor hardware address without holding the required seqlock, leading to a race condition vulnerability. This could result in misdirected network packets or information disclosure. Updating the kernel to a version that uses `neigh_ha_snapshot()` is recommended.
Azərbaycanca: Linux kernel-də VXLAN-in `route_shortcircuit()` funksiyasında qonşu cihazın aparat ünvanı (`neighbour hardware address`) seqlock qorunması olmadan oxunaraq yarış şəraiti (race condition) zəifliyinə səbəb olub. Bu zəiflik şəbəkə paketlərinin yanlış yönləndirilməsinə və ya məlumat sızmasına gətirib çıxara bilər. Təsirə məruz qalmamaq üçün kernel-i `neigh_ha_snapshot()` istifadə edən versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-200
FAQ2
In which Linux kernel network component was CVE-2026-74475 discovered?
This vulnerability was discovered in the VXLAN (Virtual Extensible LAN) component of the Linux kernel, specifically in the `route_shortcircuit()` function.
What is the root cause of the race condition in CVE-2026-74475?
The root cause is that the `route_shortcircuit()` function reads the neighbor's hardware address without holding the required `seqlock`, leading to a race condition.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.