CVE-2026-74615: vxlan: do not arm the ageing timer on a device that is down

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not arm the ageing timer on a device that is down

vxlanchangelink() arms vxlan->agetimer whenever the requested ageing interval differs from the configured one:

if (conf.ageinterval != vxlan->cfg.ageinterval) modtimer(&vxlan->agetimer, jiffies);

There is no netifrunning() test, so the timer is armed even on a device that was never brought up. The only synchronous cancel in the driver is the timerdeletesync() in vxlanstop(), which is .ndostop. netifclosemany() drops devices without IFFUP before devclosemany() runs, so that cancel is skipped for such a device.

vxlansetup() sets dev->needsfreenetdev = true and agetimer is a member of struct vxlandev, so freenetdev() releases the allocation the timer lives in while it is still queued on a timerbase. expiretimers() unlinks the entry before it loads timer->function, so the timer core writes through the freed object's list pointers:

BUG: KASAN: slab-use-after-free in runtimers+0x208/0x654 Write of size 8 at addr ffff00001adace68 by task true/192 asanstore8+0x84/0xac runtimers+0x208/0x654 runtimersoftirq+0x154/0x18c Allocated by task 189: allocnetdevmqs+0x64/0x720 rtnlcreatelink+0x4ac/0x520 rtnlnewlink+0x758/0xd00 Freed by task 191: netdevrelease+0x40/0x58 netdevruntodo+0x4a4/0x8c0 rtnldellink+0x200/0x4e8

The rtnl operations involved are netns-scoped, so an unprivileged user can perform them in a new user and network namespace.

Arming the timer on a down device never had an effect: vxlancleanup() returns early on !netifrunning(), and vxlanopen() arms the timer for any non-zero interval once the device is brought up. Add the missing test.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>