EUVD-2026-64552
GHSA-m2v3-p29r-xwmj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local vector confirmed by kernel-space exploitation; PR:L because any local user account suffices via user namespaces; S:C captures full kernel memory corruption scope beyond the unprivileged user context.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vxlan: do not arm the ageing timer on a device that is down
vxlan_changelink() arms vxlan->age_timer whenever the requested ageing interval differs from the configured one:
if (conf.age_interval != vxlan->cfg.age_interval) mod_timer(&vxlan->age_timer, jiffies);
There is no netif_running() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver is the timer_delete_sync() in vxlan_stop(), which is .ndo_stop. netif_close_many() drops devices without IFF_UP before __dev_close_many() runs, so that cancel is skipped for such a device.
vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a member of struct vxlan_dev, so free_netdev() releases the allocation the timer lives in while it is still queued on a timer_base. expire_timers() unlinks the entry before it loads timer->function, so the timer core writes through the freed object's list pointers:
BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654 Write of size 8 at addr ffff00001adace68 by task true/192 __asan_store8+0x84/0xac __run_timers+0x208/0x654 run_timer_softirq+0x154/0x18c Allocated by task 189: alloc_netdev_mqs+0x64/0x720 rtnl_create_link+0x4ac/0x520 rtnl_newlink+0x758/0xd00 Freed by task 191: netdev_release+0x40/0x58 netdev_run_todo+0x4a4/0x8c0 rtnl_dellink+0x200/0x4e8
The rtnl operations involved are netns-scoped, so an unprivileged user can perform them in a new user and network namespace.
Arming the timer on a down device never had an effect: vxlan_cleanup() returns early on !netif_running(), and vxlan_open() arms the timer for any non-zero interval once the device is brought up. Add the missing test.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
AnalysisAI
Use-after-free in the Linux kernel VXLAN driver allows a local, low-privileged user to corrupt kernel memory, potentially escalating to full kernel compromise. The flaw exists in vxlan_changelink(), which arms age_timer without checking whether the device is up via netif_running(); when the device is subsequently deleted, free_netdev() releases the vxlan_dev struct - including the embedded timer - while that timer remains queued on a timer_base. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The exploit requires a local user account on the target Linux system - remote unauthenticated exploitation is not possible given AV:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.8) is well-grounded: local vector reflects that a shell or code execution on the host is required, low complexity and low privilege reflect that any unprivileged local user can create user+network namespaces (a default-enabled capability on Ubuntu, Fedora, Debian, and most container-hosting distributions), and the scope change to C:H/I:H/A:H captures full kernel memory corruption impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unprivileged local user on a Linux system with user namespace creation enabled (the default on most modern distributions) opens a new user namespace and within it a new network namespace to obtain CAP_NET_ADMIN in that scope. The attacker then creates a VXLAN device without bringing it up (IFF_UP never set), issues a netlink RTM_SETLINK changelink operation to modify the ageing interval (triggering mod_timer on the downed device), and then immediately deletes the device via RTM_DELLINK. … |
| Remediation | The primary fix is to upgrade to a patched kernel version: 5.10.265 or later for the 5.10.x LTS branch, 5.15.216 or later for the 5.15.x LTS branch, 6.1.183 or later for the 6.1.x LTS branch, 6.6.152 or later for the 6.6.x LTS branch, 6.12.104 or later for the 6.12.x branch, 6.18.45 or later for the 6.18.x branch, and 7.1.9 or later for the 7.1.x branch; the 7.2 mainline also contains the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, consult kernel vendor advisories for CVE-2026-74615 to identify patched kernel versions applicable to your Linux distributions and systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today