CVE-2026-90105 vxlan: fix reading neigh ha
A race condition in the Linux kernel VXLAN module allows partial reads of neighbor hardware addresses, potentially leading to data corruption or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90105?
CVE-2026-90105 is a vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vxlan: fix reading neigh ha
Currently arp/neigh_reduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address similar to route_shortcircuit which already does the right thing.
Which versions are affected by CVE-2026-90105?
How do I fix CVE-2026-90105?
Apply the vendor's patch.
Is CVE-2026-90105 being exploited?
There is no known exploitation of CVE-2026-90105 in the wild and no public exploit code.
Sources
Also known as AZL-103050, BELL-CVE-2026-90105, DEBIAN-CVE-2026-90105, GHSA-6mp3-g7qw-8rgw, UBUNTU-CVE-2026-90105.