CVE-2026-74406: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

Published Aug 15, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix potential null-ptr-deref in vxlangropreparereceive().

udptunnelsockrelease() could set sk->skuserdata to NULL while vxlangropreparereceive() is running.

Let's check if rcudereferenceskuserdata() is NULL after skbgroremcsuminit().

Event History

Aug 15, 2026

CVE Published

via MITRE·05:59 AM

Data Sourced

via MITRE·05:59 AM

Description

CVE-2026-74406 has a risk rating of 19, indicating a high severity vulnerability in the Linux kernel.

To fix CVE-2026-74406, users should update their Linux kernel to the latest version where the vulnerability has been patched.

CVE-2026-74406 affects the vxlan implementation in the Linux kernel, specifically related to the vxlan_gro_prepare_receive() function.

CVE-2026-74406 is a null pointer dereference vulnerability that can occur during the processing of VXLAN packets.

CVE-2026-74406 was published on August 15, 2026.