CVE-2026-90105

A flaw was found in the Linux kernel's vxlan implementation. When arp/neigh_reduce attempts to read the neighbor hardware address (neigh ha) directly while it is being updated, it can result in partial reads. This data inconsistency can lead to unreliable network operations and potentially disrupt network connectivity.

A moderate-severity flaw was found in the VXLAN implementation of the Linux kernel as shipped in Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL CoreOS 9. When VXLAN ARP/ND neighbor suppression is active, the arp_reduce and neigh_reduce functions read the neighbor hardware address directly while the neighbor entry may be updated concurrently. This race can produce a partially read hardware address that is then used for forwarding database lookups and in generated ARP or IPv6 neighbor-discovery replies, causing incorrect layer-2 resolution, unreliable network operations, and potential disruption of VXLAN overlay connectivity. Red Hat rates this flaw as Moderate with a CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting an availability impact with no direct confidentiality impact. Red Hat Enterprise Linux 6, 7, and 8 kernels, their kernel-rt variants, and the OpenShift Container Platform release built on RHEL CoreOS 8 are not affected because the vulnerable code is not present. For the affected products, the fix is deferred to a future planned kernel update: reliable triggering requires a precisely timed race during a neighbor-table update on a system using VXLAN neighbor suppression, and the practical consequence is traffic disruption rather than memory corruption or privilege escalation. The residual risk while the fix is deferred is therefore limited to incorrect neighbor resolution and possible connectivity disruption on VXLAN overlays with neighbor suppression enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.