CVE-2026-74615

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not arm the ageing timer on a device that is down

vxlan_changelink() arms vxlan->age_timer whenever the requested ageing

interval differs from the configured one:

if (conf.age_interval != vxlan->cfg.age_interval)

mod_timer(&vxlan->age_timer, jiffies);

There is no netif_running() test, so the timer is armed even on a device

that was never brought up. The only synchronous cancel in the driver is

the timer_delete_sync() in vxlan_stop(), which is .ndo_stop.

netif_close_many() drops devices without IFF_UP before

__dev_close_many() runs, so that cancel is skipped for such a device.

vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a

member of struct vxlan_dev, so free_netdev() releases the allocation the

timer lives in while it is still queued on a timer_base.

expire_timers() unlinks the entry before it loads timer->function, so

the timer core writes through the freed object's list pointers

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References