{"id":"CVE-2026-74475","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use neigh_ha_snapshot() in route_shortcircuit()\n\nThe neighbour hardware address n->ha can be updated asynchronously by the\nneighbour subsystem, protected by n->h…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use neigh_ha_snapshot() in route_shortcircuit()\n\nThe neighbour hardware address n->ha can be updated asynchronously by the\nneighbour subsystem, protected by n->h…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","vendor":"Linux","product":"Linux","affected":["Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 32a9590a8d30426e3db63e6b20893e47e02576c0","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < d0993fc053f29e15cc7c9fe2029df3882a2ab5ab","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 87210054bad82bbae6f483a742dc45722fb47a6b","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < ec341bb76d77b4c2948764375ee6bfeef4bb41c3","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < ff89415d34c3ab9f5312316423122e664ed3524f","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 05f2987f73daa05333fd713d05546142f9f7c5f0","Linux >= e4f67addf158f98f8197e08974966b18480dc751 < 8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d","Linux 3.8"],"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:30.450","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74475","references":[{"url":"https://git.kernel.org/stable/c/05f2987f73daa05333fd713d05546142f9f7c5f0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32a9590a8d30426e3db63e6b20893e47e02576c0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87210054bad82bbae6f483a742dc45722fb47a6b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8eca411347e1d38964f9ed2c8d3b6ab0e7e4473d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d08e8ac13f2e228cc7fc3c70b5ebe71557b624a0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0993fc053f29e15cc7c9fe2029df3882a2ab5ab","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec341bb76d77b4c2948764375ee6bfeef4bb41c3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff89415d34c3ab9f5312316423122e664ed3524f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00454,"epssPercentile":0.39258,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T18:57:29.550730Z"},"ingestedAt":"2026-10-16T19:46:24.357Z","slug":"CVE-2026-74475","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use neigh_ha_snapshot() in route_shortcircuit()\n\nThe neighbour hardware address n->ha can be updated asynchronously by the\nneighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without\nholding the seqlock loop can lead to torn reads or reading a partially updated\nMAC address.\n\nUse neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under\nread_seqbegin()/read_seqretry() lock protection before using it.\n\nNote that arp_reduce() and neigh_reduce() seem to have the same issue\nleft for future patches.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}