CVE-2026-74615

A flaw was found in the Linux kernel's vxlan module. An unprivileged user can trigger a use-after-free vulnerability by performing specific network-related operations within a new user and network namespace. This can lead to system instability, causing a denial of service, and potentially allowing for arbitrary code execution.

Red Hat has evaluated this issue as having an Important severity because an unprivileged local attacker can exploit this use-after-free condition to cause a system crash or potentially achieve elevated privileges. By creating unprivileged user and network namespaces, a local user can configure down network interfaces to trigger timer corruption without administrative rights. Red Hat Enterprise Linux 8 is not affected because the vulnerable timer handling logic is not present in its kernel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the vxlan kernel module from loading by creating a modprobe configuration file:

echo "install vxlan /bin/true" > /etc/modprobe.d/disable-vxlan.conf

If the module is already loaded into memory, a system reboot is required for this change to take effect.

Alternatively, unprivileged user namespaces can be disabled to prevent non-root users from triggering namespace-scoped network interface modifications:

echo "user.max_user_namespaces = 0" > /etc/sysctl.d/99-userns.conf

sysctl -p /etc/sysctl.d/99-userns.conf

Caveats: Disabling the vxlan module prevents the creation and operation of VXLAN tunnel and overlay networks. Disabling unprivileged user namespaces will impact rootless container engines, including rootless Podman.