CVE-2026-74406 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
A race condition in the Linux kernel VXLAN driver can cause a null pointer dereference, leading to a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74406?
CVE-2026-74406 is a critical vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
udp_tunnel_sock_release() could set sk->sk_user_data to NULL while vxlan_gro_prepare_receive() is running.
Let's check if rcu_dereference_sk_user_data() is NULL after skb_gro_remcsum_init().
Which versions are affected by CVE-2026-74406?
How do I fix CVE-2026-74406?
Apply the vendor's patch.
Is CVE-2026-74406 being exploited?
There is no known exploitation of CVE-2026-74406 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-74406, DEBIAN-CVE-2026-74406, GHSA-86mr-r4jr-f66c, UBUNTU-CVE-2026-74406.