In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

udp_tunnel_sock_release() could set sk->sk_user_data to NULL
while vxlan_gro_prepare_receive() is running.

Let's check if rcu_dereference_sk_user_data() is NULL after
skb_gro_remcsum_init().

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
5602c48cf87562c2f95b831d690631935e834295 affected < 9c58c729d32e7cea5772cc44929c6cd61e5a31cd
5602c48cf87562c2f95b831d690631935e834295 affected < f79c80f173fda9545b220c1f094b65fc06c252d0
5602c48cf87562c2f95b831d690631935e834295 affected < 08f40c0d23c67c3aa4224c3311e134999c721fb4
5602c48cf87562c2f95b831d690631935e834295 affected < 4a8cde6f7281ea2c4c290f9ad9923b3631defceb
5602c48cf87562c2f95b831d690631935e834295 affected < ef44dac2a37f86eeae6b88ed10a6d60b35387dfd
5602c48cf87562c2f95b831d690631935e834295 affected < 30a45c0bffdd62350261e2f2689fdba426a33578
Linux Linux affected
Version Status Constraints
4.7 affected —
0 unaffected < 4.7
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/08f40c0d23c67c3aa4224c3311e134999c721fb4 cve-icon cve-icon
https://git.kernel.org/stable/c/30a45c0bffdd62350261e2f2689fdba426a33578 cve-icon cve-icon
https://git.kernel.org/stable/c/4a8cde6f7281ea2c4c290f9ad9923b3631defceb cve-icon cve-icon
https://git.kernel.org/stable/c/9c58c729d32e7cea5772cc44929c6cd61e5a31cd cve-icon cve-icon
https://git.kernel.org/stable/c/ef44dac2a37f86eeae6b88ed10a6d60b35387dfd cve-icon cve-icon
https://git.kernel.org/stable/c/f79c80f173fda9545b220c1f094b65fc06c252d0 cve-icon cve-icon
History

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). udp_tunnel_sock_release() could set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is running. Let's check if rcu_dereference_sk_user_data() is NULL after skb_gro_remcsum_init().
Title vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:59:15.385Z

Reserved: 2026-08-15T05:44:03.892Z

Link: CVE-2026-74406

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:42.633

Modified: 2026-08-15T06:22:42.633

Link: CVE-2026-74406

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.