CVE-2026-74406

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) component. A race condition can occur where the udp_tunnel_sock_release() function sets a socket's user data to NULL while the vxlan_gro_prepare_receive() function is still actively using it. This could lead to a null pointer dereference, potentially causing a system crash or denial of service.

A moderate impact NULL pointer dereference flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) implementation, affecting Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2. A race condition can occur in which udp_tunnel_sock_release() sets a socket's user data (sk_user_data) to NULL while vxlan_gro_prepare_receive() is still using it to process received VXLAN packets. If this race is triggered while packet reception on a VXLAN tunnel coincides with tunnel socket teardown, the kernel dereferences the NULL pointer, causing a kernel crash and denial of service. No impact to confidentiality or integrity is expected, and successful exploitation depends on hitting a narrow timing window between socket release and packet reception.

Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those supported streams.

The fix for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 releases has been deferred and is planned to be addressed in a future update. Until a fix is delivered, the residual risk is limited to a potential kernel crash (denial of service) if the race condition is triggered.

Red Hat rates this flaw as Moderate severity (CVSS 3.1 score 5.5), which differs from the upstream CVE.org score of 9.8 (Critical). The upstream score assumes a network attack vector with high confidentiality and integrity impact, whereas the verified technical evidence shows a denial-of-service-only NULL pointer dereference that depends on winning a narrow race during tunnel teardown.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.