Executive brief
VXLAN (Virtual Extensible LAN) is a Linux kernel networking feature used to create virtualized networks over existing infrastructure. This vulnerability allows a local unprivileged user to cause a kernel crash (denial of service) by creating and destroying network devices through privileged namespace operations, triggering a use-after-free memory bug in the timer management code.
Technical details
The vulnerability is a use-after-free in the VXLAN ageing timer mechanism. The vxlan_changelink() function arms the age_timer without checking if the device is running (netif_running()), allowing the timer to be queued on a downed device. When the device is freed via free_netdev(), the timer remains queued on the timer_base. Later, when the timer core attempts to process the expired timer, it accesses freed memory through the timer's list pointers. An unprivileged user can trigger this via rtnl operations in a new network namespace. The fix is a simple netif_running() test before arming the timer, as vxlan_cleanup() already returns early for down devices and vxlan_open() arms the timer when brought up.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-22: disclosed
- other: CVE-2026-74615