What is the CVSS score of CVE-2026-74475?

CVE-2026-74475 has a contested CVSS base score of 10.0 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-74475?

Linux systems using VXLAN for network virtualization are affected by a kernel race condition that can cause inconsistent packet forwarding behavior.. A patch is available.

How to fix or mitigate CVE-2026-74475?

Within 24 hours, identify Linux systems in your infrastructure using VXLAN and their kernel versions by checking vendor advisories for affected versions of CVE-2026-74475. Within 7 days, validate the available kernel patch in your non-production VXLAN test environment to confirm forwarding stability. Within 30 days, apply the patched kernel version across all production VXLAN deployments according to your standard change management procedures.

Linux Kernel CVE-2026-74475

EUVD-2026-59668 CRITICAL

2026-08-15 Linux

GHSA-g8xx-g6f9-m789

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 10.0 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

3.6 LOW

Torn read of an internal MAC via a timing race needs local access and a hard-to-win window (AV:L/AC:H/PR:L); impact is limited to inconsistent data, so C:L/I:L and no availability loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

3.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:40 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

10.0 (CRITICAL)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

CRITICAL 10.0

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vxlan: use neigh_ha_snapshot() in route_shortcircuit()

The neighbour hardware address n->ha can be updated asynchronously by the neighbour subsystem, protected by n->ha_lock seqlock. Reading n->ha without holding the seqlock loop can lead to torn reads or reading a partially updated MAC address.

Use neigh_ha_snapshot() in route_shortcircuit() to safely copy n->ha under read_seqbegin()/read_seqretry() lock protection before using it.

Note that arp_reduce() and neigh_reduce() seem to have the same issue left for future patches.

AnalysisAI

Race-condition torn read in the Linux kernel's VXLAN driver (route_shortcircuit()) allows the neighbour hardware address (n->ha) to be read without holding the n->ha_lock seqlock, producing a partially-updated or corrupted MAC address while the neighbour subsystem concurrently updates it. Fixed by switching to neigh_ha_snapshot() for a seqlock-protected read. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach host with active VXLAN overlay

Delivery

Generate ARP/ND traffic hitting route_shortcircuit()

Exploit

Race concurrent n->ha neighbour update

Execution

Trigger torn read of MAC address

Impact

Cause inconsistent VXLAN forwarding

Access

Reach host with active VXLAN overlay

Delivery

Generate ARP/ND traffic hitting route_shortcircuit()

Exploit

Race concurrent n->ha neighbour update

Execution

Trigger torn read of MAC address

Impact

Cause inconsistent VXLAN forwarding

Vulnerability AssessmentAI

Exploitation	Requires the host to have VXLAN interfaces actively configured and forwarding traffic, and requires the VXLAN route_shortcircuit() proxy path to execute (i.e., short-circuit/proxy behavior in use) concurrently with an asynchronous neighbour hardware-address update - a genuine race window on n->ha. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are sharply contradictory and should be read with skepticism. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker or workload sharing a host with an active VXLAN overlay generates traffic that repeatedly triggers route_shortcircuit() while the neighbour subsystem is concurrently updating a neighbour's MAC address, hoping to win the race and cause a torn read. The likely outcome is a corrupted/inconsistent MAC being used for a short-circuited ARP/ND reply, causing misforwarding rather than code execution. …
Remediation	Vendor-released patch: update to a fixed stable kernel - 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 (or later in each series). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify Linux systems in your infrastructure using VXLAN and their kernel versions by checking vendor advisories for affected versions of CVE-2026-74475. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74475 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74475

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code