CVE-2026-74615 Overview
CVE-2026-74615 is a use-after-free vulnerability in the Linux kernel's VXLAN driver. The flaw exists in vxlan_changelink(), which arms the age_timer when the requested ageing interval differs from the configured one without checking whether the device is running. When the underlying struct vxlan_dev is freed through free_netdev(), the timer core writes through freed memory during expire_timers(), producing a KASAN slab-use-after-free report in __run_timers().
The rtnl operations required to trigger the flaw are netns-scoped, so an unprivileged user can reach the vulnerable code path from a new user and network namespace.
Critical Impact
A local unprivileged user can trigger kernel memory corruption in the VXLAN driver, enabling denial of service and potential local privilege escalation.
Affected Products
- Linux kernel with VXLAN driver (drivers/net/vxlan/) enabled
- Distributions shipping affected upstream kernels prior to the referenced stable commits
- Systems permitting unprivileged user namespaces with network namespace creation
Discovery Timeline
- Vulnerability discovered by XBOW and triaged by Baul Lee
- 2026-08-22 - CVE-2026-74615 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74615
Vulnerability Analysis
The VXLAN driver maintains a forwarding database ageing timer, vxlan->age_timer, embedded inside struct vxlan_dev. The vxlan_changelink() netlink handler updates VXLAN configuration and unconditionally arms the timer when the ageing interval changes:
if (conf.age_interval != vxlan->cfg.age_interval) mod_timer(&vxlan->age_timer, jiffies);
The handler omits a netif_running() check, so the timer is queued even on a device that was never brought up. The only synchronous cancel path is timer_delete_sync() inside vxlan_stop(), which the kernel invokes through .ndo_stop. netif_close_many() skips devices without IFF_UP before reaching __dev_close_many(), so the cancel never runs for a down device.
Root Cause
vxlan_setup() sets dev->needs_free_netdev = true, so free_netdev() releases the entire allocation containing age_timer while the timer remains linked on a timer_base. When the timer fires, expire_timers() unlinks the entry before loading timer->function, causing the timer core to write through the freed object's list pointers. KASAN reports the fault as an 8-byte write in __run_timers+0x208/0x654.
Attack Vector
A local attacker creates a new user namespace and network namespace, then uses RTM_NEWLINK and RTM_SETLINK netlink messages to create a VXLAN interface and modify its ageing interval without bringing it up. Deleting the interface with RTM_DELLINK frees the vxlan_dev while the timer is still armed. When the timer expires on the softirq path, the kernel corrupts freed slab memory, producing a use-after-free that can be shaped into denial of service or memory corruption primitives.
No verified public exploit code is available. Refer to the upstream stable commit 26c179d for the exact patch diff.
Detection Methods for CVE-2026-74615
Indicators of Compromise
- KASAN slab-use-after-free reports referencing __run_timers, run_timer_softirq, or vxlan_cleanup in kernel logs
- Unexpected kernel oops or panic messages tied to VXLAN interface teardown
- Processes creating VXLAN links inside unprivileged user namespaces followed by rapid RTM_DELLINK operations
Detection Strategies
- Audit rtnetlink activity for creation and deletion of VXLAN interfaces by non-root UIDs
- Enable kernel lockdown and KASAN in test environments to catch exploitation attempts against unpatched kernels
- Correlate unshare and clone syscalls carrying CLONE_NEWUSER and CLONE_NEWNET with subsequent netlink vxlan operations
Monitoring Recommendations
- Ship dmesg and /var/log/kern.log to a central log store and alert on KASAN, BUG, or WARN entries referencing timer or VXLAN symbols
- Monitor auditd rules on sys_unshare, sys_setns, and netlink socket creation for anomalous frequency
- Track kernel version inventory to identify hosts still running pre-patch builds referenced in the stable commits
How to Mitigate CVE-2026-74615
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable commits and reboot affected hosts
- Restrict unprivileged user namespace creation on servers that do not require it by setting kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0
- Prioritize patching on multi-tenant hosts, container platforms, and shared build systems where local users are untrusted
Patch Information
The fix adds the missing netif_running() check so vxlan_changelink() no longer arms age_timer on a device that is down. Arming the timer on a down device had no functional effect: vxlan_cleanup() returns early on !netif_running(), and vxlan_open() re-arms the timer once the device comes up. The change is available in upstream stable trees through commits 26c179d, 46bb297, 619dd29, 6b095e9, 6b4119a, 9dc561f, b379716, and be44d79.
Workarounds
- Disable unprivileged user namespaces where operationally acceptable to remove the path an attacker uses to reach rtnl_newlink
- Blacklist the vxlan kernel module on systems that do not require overlay networking using install vxlan /bin/true in /etc/modprobe.d/
- Restrict CAP_NET_ADMIN in container runtimes and Kubernetes pod security policies to prevent VXLAN link management from workloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
