Not yet scoredPublished Sep 17, 2026

CVE-2026-90105vxlan: fix reading neigh ha

Updated under an hour ago (Oct 27, 2026, 3:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neigh_reduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address similar to route_shortcircuit which already does the right thing.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e4f67addf158f98f8197e08974966b18480dc751 before 6093baf2b2c57e7da33bacd2223570a78b416d89; from e4f67addf158f98f8197e08974966b18480dc751 before 751cb520f9e47538b7223df133806a29fc41f54f; from e4f67addf158f98f8197e08974966b18480dc751 before f43ef9a3f9c121472a0754c9e9bff13317ace0f7; from e4f67addf158f98f8197e08974966b18480dc751 before ecc8bac11a101e5f6989a14b92e17b51f9761630; from e4f67addf158f98f8197e08974966b18480dc751 before b824059a673b2283e78c7aae2c7d257aad7f0e1d	CNA record

References

References

https://git.kernel.org/stable/c/6093baf2b2c57e7da33bacd2223570a78b416d89
https://git.kernel.org/stable/c/751cb520f9e47538b7223df133806a29fc41f54f
https://git.kernel.org/stable/c/f43ef9a3f9c121472a0754c9e9bff13317ace0f7
https://git.kernel.org/stable/c/ecc8bac11a101e5f6989a14b92e17b51f9761630
https://git.kernel.org/stable/c/b824059a673b2283e78c7aae2c7d257aad7f0e1d

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.