CVE-2026-74615

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vxlan: do not arm the ageing timer on a device that is down<br /> <br /> vxlan_changelink() arms vxlan-&gt;age_timer whenever the requested ageing<br /> interval differs from the configured one:<br /> <br /> if (conf.age_interval != vxlan-&gt;cfg.age_interval)<br /> mod_timer(&amp;vxlan-&gt;age_timer, jiffies);<br /> <br /> There is no netif_running() test, so the timer is armed even on a device<br /> that was never brought up. The only synchronous cancel in the driver is<br /> the timer_delete_sync() in vxlan_stop(), which is .ndo_stop.<br /> netif_close_many() drops devices without IFF_UP before<br /> __dev_close_many() runs, so that cancel is skipped for such a device.<br /> <br /> vxlan_setup() sets dev-&gt;needs_free_netdev = true and age_timer is a<br /> member of struct vxlan_dev, so free_netdev() releases the allocation the<br /> timer lives in while it is still queued on a timer_base.<br /> expire_timers() unlinks the entry before it loads timer-&gt;function, so<br /> the timer core writes through the freed object&amp;#39;s list pointers:<br /> <br /> BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654<br /> Write of size 8 at addr ffff00001adace68 by task true/192<br /> __asan_store8+0x84/0xac<br /> __run_timers+0x208/0x654<br /> run_timer_softirq+0x154/0x18c<br /> Allocated by task 189:<br /> alloc_netdev_mqs+0x64/0x720<br /> rtnl_create_link+0x4ac/0x520<br /> rtnl_newlink+0x758/0xd00<br /> Freed by task 191:<br /> netdev_release+0x40/0x58<br /> netdev_run_todo+0x4a4/0x8c0<br /> rtnl_dellink+0x200/0x4e8<br /> <br /> The rtnl operations involved are netns-scoped, so an unprivileged user<br /> can perform them in a new user and network namespace.<br /> <br /> Arming the timer on a down device never had an effect: vxlan_cleanup()<br /> returns early on !netif_running(), and vxlan_open() arms the timer for<br /> any non-zero interval once the device is brought up. Add the missing<br /> test.<br /> <br /> Discovered by XBOW, triaged by Baul Lee