CVE-2026-74406 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

vxlan: require CAP_NET_ADMIN in the device netns for changelink

...

PT-2026-72925

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the VXLAN implementation where the route shortcircuit function incorrectly uses pskb may pull to verify the availability of bytes for the IP header. Because skb-data...

CVE-2026-74475: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vxlan: use neighhasnapshot in routeshortcircuit The neighbour hardware address n-ha can be updated asynchronously by the neighbour subsystem, protected by n-halock seqlock. Reading n-ha without holding the seqlock loop can lead t...

PT-2026-72926

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the VXLAN implementation where pskb may pull was used instead of pskb network may pull to verify the availability of network layer headers, such as ARP, IPv6/ND, and...

CVE-2026-74473: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are available starting from skb-data. However, in vxlanxmit, skb-data point...

PT-2026-72842

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null-pointer dereference can occur in the vxlan gro prepare receive function. This happens because udp tunnel sock release may set the sk-sk user data variable to NULL while vxlan gro...

PT-2026-72927

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the vxlan module, the route shortcircuit function reads the neighbour hardware address n-ha without holding the n-ha lock seqlock. Because the neighbour subsystem can update n-ha...

Linux Distros Unpatched Vulnerability : CVE-2026-74406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let...

Linux Distros Unpatched Vulnerability : CVE-2026-74475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: use neighhasnapshot in routeshortcircuit The neighbour hardware address n-ha can be updated asynchronously by the neighbour subsystem, protected by...

Linux Distros Unpatched Vulnerability : CVE-2026-74474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the...

CVE-2026-74406: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

Linux Distros Unpatched Vulnerability : CVE-2026-74473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vxlan: use pskbnetworkmaypull in routeshortcircuit routeshortcircuit currently calls pskbmaypullskb, sizeofstruct iphdr or ipv6hdr, which checks if bytes are...

PT-2026-72975

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the recovery path of the qede NIC driver when VXLAN or GENEVE tunnel ports are configured. A transmit TX timeout triggers the qede recovery handler function, which...

CVE-2026-74474: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

SUSE CVE-2026-68116

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix source list corruption on a failed replace When replacing the source list of an MDB remote entry, all existing sources are first marked for deletion and vxlanmdbremotesrcsadd is then called to add the new source...

SUSE CVE-2026-68432

In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns vxlan-net. They differ once the device is created in or moved to a netns oth...

CVE-2026-68432

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

DEBIAN-CVE-2026-68432

In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns vxlan-net. They differ once the device is created in or moved to a netns oth...