CVE-2026-74475

A flaw was found in the Linux kernel's VXLAN (Virtual Extensible LAN) implementation. An issue exists where the neighbor hardware address (MAC address) could be read incorrectly due to a lack of proper synchronization. This could lead to the system using a partially updated or corrupted MAC address, potentially causing network communication issues or unexpected behavior.

VXLAN route_shortcircuit reads the neighbour hardware address while it may be updated asynchronously by the neighbour subsystem, which can produce a torn or partially updated MAC address. The mixed MAC value can then be used when comparing and rewriting the Ethernet destination address, causing packet misdelivery, transient traffic blackholing, or weaker forwarding integrity. For the CVSS the PR:N is used because an adjacent network attacker may not need local code execution if they can influence neighbour resolution while VXLAN route_shortcircuit is active. The issue is network adjacent rather than generally Internet reachable, and exploitation depends on timing a race during neighbour hardware address updates. Impact is mainly forwarding disruption and possible limited confidentiality or integrity impact for affected traffic, not kernel memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.